> ## Content Index
> Fetch the complete content index at: https://globalfeed.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Embedded browsers in five AI coding tools have flaws, with Codex and VS Code unpatched
- URL: https://globalfeed.ai/en/embedded-browsers-in-five-ai-coding-tools-have-flaws-with-codex-and-vs-code-unpatched/
- Published: 2026-10-30T20:10:03.000Z
- Updated: 2026-10-30T20:10:03.000Z
- Description: Forever Security found flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop that allow code execution, file reads and address-bar spoofing. The firm says the Codex and VS Code issues were still open at publication.
- Author: GlobalFeed Editor
- Tags: OpenAI, Codex, VS Code, Cursor, GitHub Copilot, Claude, cybersecurity, x-OpenAI, dil-en, elle

Security firm Forever Security said in [research published on October 29, 2026](https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical?ref=globalfeed.ai) that it found flaws in the browsers built into Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. It calls the class EMBRACE, short for an embedded browser trusted like a real one. At publication, the Codex and VS Code issues were still open.

## Extra powers given to the browser

According to the research, the bugs differ across the five products while the root cause is the same. These tools give the embedded browser powers a normal browser lacks so that the AI agent can read and use pages, and a hostile page or file can turn those powers against the user.

In Cursor, a web page could use the bridge between the browser and the agent to send hidden instructions to the agent's command box. In testing, the agent ran a package install, hit a sandbox block, turned the block off itself and retried, and Calculator opened on the machine. Forever says the outcome depends on the model. In GitHub Copilot 1.1.27, a page could make both the user and the agent believe it was on github.com/login.

In Codex, VS Code and Claude Desktop, the problem was in local HTML files. In VS Code and Claude Desktop, the project-folder limit could be bypassed from a web worker, and in Codex the researchers found no such limit on the page. Forever showed that SSH keys, .env files and npm tokens could be read this way. The victim has to open the file, but the researchers say an agent asked to set up a project can hand the user the clickable file link itself.

## Patch status

According to Forever's timeline, the Cursor issue was reported on September 10 and fixed on October 1\. GitHub fixed the Copilot issue in version 1.1.29 on October 13\. The Codex issue was reported to OpenAI on July 27, and the firm says it got no reply. The VS Code issue was reported to Microsoft on September 10, and Microsoft declined it as invalid under Workspace Trust. Anthropic declined a July 23 report on the same grounds, then accepted a report from Noma Security the next day as valid. The research does not separately state Claude Desktop's current status, and it names Codex and VS Code as the products still open.

This account rests on Forever Security's own research. Until patches arrive, it helps to avoid opening unfamiliar local HTML files in embedded browsers, even when an agent suggests them. For a fuller picture, follow reviews from independent researchers too.

Sources: [Forever Security (technical post)](https://forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical?ref=globalfeed.ai), [Hackread](https://hackread.com/embrace-flaws-ai-coding-tools-code-execution-theft/?ref=globalfeed.ai)