# News: Researchers disclose 'Embrace' flaws in 5 AI coding tools' embedded browsers — Codex and VS Code fixes still outstanding

> On 29 October 2026, AI security firm Forever Security published vulnerabilities across five AI developer tools - Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex - all sharing one root cause it names Embrace (EMbedded BRowser): each tool's built-in browser grants web pages capabilities a normal browser refuses. In Cursor, a page could invoke the agent's composer with instructions hidden from the human user, a prompt-injection path to arbitrary code execution on the host; disclosed 10 September, Cursor patched silently on 1 October with no security advisory. In GitHub Copilot 1.1.27, a page could dictate the address bar's displayed URL while loading a different site (phishing spoofing); found 26 September, GitHub fixed it independently in build 1.1.29 on 13 October. In Claude Desktop and VS Code, a local HTML page could reach any file on the machine through a web worker that bypassed project-folder restrictions, and in Codex a local page could read any file directly; the Codex and VS Code flaws remain unpatched per the researchers, with OpenAI saying it is aware and working to address them. Anthropic declined Forever's 23 July Claude Desktop report as invalid but accepted the same flaw after a report from Noma Security.

Human page: https://testedactually.com/news/embrace-embedded-browser-vulnerabilities/
Mirror: https://testedactually.com/news/embrace-embedded-browser-vulnerabilities.md
Published: 2026-10-30

## What changed

On 29 October 2026, AI security firm Forever Security published vulnerabilities across five AI developer tools - Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex - all sharing one root cause it names Embrace (EMbedded BRowser): each tool's built-in browser grants web pages capabilities a normal browser refuses. In Cursor, a page could invoke the agent's composer with instructions hidden from the human user, a prompt-injection path to arbitrary code execution on the host; disclosed 10 September, Cursor patched silently on 1 October with no security advisory. In GitHub Copilot 1.1.27, a page could dictate the address bar's displayed URL while loading a different site (phishing spoofing); found 26 September, GitHub fixed it independently in build 1.1.29 on 13 October. In Claude Desktop and VS Code, a local HTML page could reach any file on the machine through a web worker that bypassed project-folder restrictions, and in Codex a local page could read any file directly; the Codex and VS Code flaws remain unpatched per the researchers, with OpenAI saying it is aware and working to address them. Anthropic declined Forever's 23 July Claude Desktop report as invalid but accepted the same flaw after a report from Noma Security.

## What it means for buyers

The agent's own browser is now an attack surface that reaches past the codebase to the host: anyone running coding agents against untrusted web content is trusting an embedded-browser threat model the vendors did not originally sign up for. Until the outstanding Codex and VS Code fixes land, avoid pointing those agents at untrusted pages, and treat security responsiveness - advisory or silence - as a differentiator in our ai-coding-assistants and agentic-code-review comparisons.

## Sources

- [1] Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched (The Register) - https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508/ (29 October 2026: Embrace class, per-tool outcomes, disclosure timelines, vendor responses, checked 2026-10-30)
- [2] Embrace: hacking 5 AI assistants' embedded browsers (Forever Security) - https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical (researcher's technical report, 29 October 2026, checked 2026-10-30)

TestedActually tracks pricing and programme changes as dated, sourced events: https://testedactually.com/news/.