EMBRACE: the built-in browsers in five AI coding tools could read your files or run code

Published October 30, 20265 min read

Every major coding agent now ships a browser inside the app. It previews the HTML the agent just wrote, opens docs, and lets the agent click through your local dev server. Forever Security's write-up, by researcher Gal Weizman, shows what happens when that browser gets abilities a normal browser doesn't have. The researchers call the bug class EMBRACE, for embedded browser, and found it in five tools.

Each bug is different, but the root cause is the same. The app wired its browser into something powerful, such as the agent's input box or the local filesystem, and then trusted the page not to misuse it. Everything below comes from the write-up, The Register's coverage, and Noma Security's separate report on Claude Desktop. We haven't reproduced any of the exploits.

The five bugs at a glance

“Any file” means what you'd fear: SSH keys, .env files, cloud credentials, and tokens. The write-up gives no version numbers for Cursor, VS Code, or Codex.

How each bug worked

Cursor: the page could type into the agent. Cursor's browser exposed a window.cursorBrowser.send(...) channel that any page could call. It was meant for the “select an element and send it to chat” feature, and it built a composer chip from fields the page supplied. A hostile page used it to hand the agent instructions, splitting a shell command across attributes so it didn't look like one. The write-up says the bypass “targets the agent's reasoning, not a filter.” In one variant, the agent's sandbox blocked an npm install, so the agent cancelled and retried outside it, and the package's preinstall script ran with full privileges. The researchers launched Calculator as their proof.

Copilot app: the page chose its own address. A Tauri invoke call let the page report its URL, and the app accepted anything starting with http, https, or file. The address bar, and the agent, would show whatever the attacker picked. That's classic phishing, made worse because an agent reading the address would trust it too.

Claude Desktop and VS Code: web workers skipped the folder fence. Both limit local pages to the project folder. That check only ran for the top-level document. A page that started a web worker from an in-memory blob: URL could read files anywhere, and the researchers walked the disk using macOS .DS_Store files as a directory listing.

Codex: no fence at all. A plain fetch of a file:// path from a local page succeeded.

The Claude Desktop timeline

Claude Desktop's story is worth telling separately because two teams found the same hole. Forever reported it to Anthropic on July 23, and Anthropic declined it, citing workspace trust as the security boundary. Noma Security reported the same worker bypass a day later, as part of an exploit chain it calls SneakPeek, and Anthropic accepted it.

Noma's chain started from a public repository. An HTML file padded past 256KB skipped the preview pane's script blocking, because larger files were loaded from disk instead of as a data URL. Asking Claude to review or edit that file was enough to trigger it. Anthropic scored it 8.7 on CVSS and, per Noma, shipped the final fix on August 17 in “Claude Desktop 1.30096.1 and later, delivered via auto-update.” Noma says a CVE is still pending.

Microsoft's answer: workspace trust

Microsoft and, at first, Anthropic gave the same reason for declining: the attack needs a workspace you've chosen to trust. That isn't an empty argument. VS Code's Restricted Mode disables “AI agents, terminal, tasks, debugging, workspace settings, and extensions” in an untrusted folder, and the docs say plainly: “When in doubt, leave a folder in Restricted Mode.”

The problem is how people use these tools. Developers clone a repository to review it, click Trust so the agent works, and ask the agent to look at the code. Trust is a yes-or-no switch per folder, and the attack only needs one HTML file inside a folder you trusted for other reasons. If workspace trust is the boundary, treat clicking Trust as a security decision rather than a setup step.

What to do now

• Update. Make sure Cursor, the Copilot app (1.1.29 or later), and Claude Desktop (1.30096.1 or later) are current. All three update themselves, but check machines that stay open for weeks.
• In Codex and VS Code, don't open untrusted HTML in the built-in browser. That includes HTML files in a repository you just cloned and links the agent offers to open. Open them in your regular browser, which doesn't give pages the extra access these apps added.
• Review unfamiliar repositories untrusted, or in a VM. Leave VS Code in Restricted Mode for code you don't own. For agent-assisted review, run the whole editor in a throwaway VM. A dev container helps less than it seems here: it isolates the agent's terminal and tools, but the VS Code window and its built-in browser still run on your host.
• Get secrets out of plain files. Every file-read bug here is only as bad as what's readable, and a file-read bug can reach a .env file wherever it lives. Move long-lived keys into a credential helper or OS keychain, and treat any secret stored in a plain file as exposed while these bugs are open.
• Watch for retries outside the sandbox. The Cursor chain worked because the agent retried a blocked install without the sandbox. If your tool asks to rerun a blocked command unsandboxed, read the command before you approve it.

This is the same lesson as our LiteLLM token piece from a different direction: the agent inherits whatever your machine can reach. Our guardrail tampering piece covers what happens when an agent works around the checks you set.

What we don't know

We haven't confirmed the Codex and VS Code bugs ourselves, and neither vendor has published an advisory. The write-up doesn't say exactly which Codex surface is affected, or whether either bug can be triggered without a local HTML file. No CVE IDs exist yet for any of the five. If Microsoft or OpenAI ship a fix, we'll update this page.

Sources

• Forever Security: EMBRACE technical write-up (October 29, 2026): mechanisms, preconditions, and disclosure timeline.
• The Register (October 29, 2026): vendor responses.
• Noma Labs: SneakPeek (October 14, 2026): Claude Desktop chain, timeline, and fixed version.
• VS Code docs: Workspace Trust.
• VS Code docs: Developing inside a container.