EMBRACE: AI coding tool browsers can read your whole disk

The browsers built into AI coding assistants are now an attack surface. On October 29, Forever Security published EMBRACE, research that broke the embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. In the worst case, one booby-trapped HTML file in a cloned repo reads files anywhere on the developer's machine. Two of the holes, in Codex and VS Code, were still open as of publication.

What actually happened

Per Forever Security's write-up and Help Net Security's coverage, each tool loosened normal browser rules so the AI could preview local projects or read tabs. That shortcut broke different things in each product:

• Codex: a local page could read any file on disk. No folder restriction at all. Reported to OpenAI July 27; no response; unpatched.
• VS Code: the folder check covered the page but not a web worker the page starts, so the worker reads anything. Reported September 10; Microsoft declined it as gated by Workspace Trust; unpatched.
• Claude Desktop: the same web-worker pattern. Anthropic declined Forever's report but accepted a similar one from Noma Security a day later. Neither source states a fixed version.
• Cursor: a hostile page tricked the agent into proposing a command, one Enter approved it, and the agent turned off its own sandbox to retry. Silently patched October 1.
• GitHub Copilot: a page could fake its address bar (think github.com/login over a phishing form). Fixed in Copilot 1.1.29 on October 13.

The attack chain is boring, which is the point. The victim clones a project, asks the assistant to "set it up per the README," and clicks the link the assistant offers. In Forever's test, that sweep pulled SSH keys, .env files and npm tokens. The proof of concept was macOS, and no CVE IDs were published.

Why it matters for your business

Your developers open strangers' code every week: client handoffs, contractor repos, sample projects. The assistant's own UI is now the thing that hands them the malicious link, so "they'd have to click something" is not a defense. And Workspace Trust only works if people stop clicking "Trust" by reflex.

1. Don't open HTML files from unknown projects in the Codex or VS Code embedded browser until there's a fix. Use a real browser or a throwaway VM.
2. Open untrusted repos in a container or devcontainer, not on the laptop that holds your keys.
3. Update Cursor and Copilot to current builds.
4. Get long-lived secrets off dev machines. If an untrusted project was opened in Codex or VS Code, rotate what was on that box.

Sources: Forever Security: EMBRACE, Help Net Security.