'Embrace' flaws in five AI developer tools enable RCE, file theft and URL spoofing; Codex and VS Code unpatched
AI security startup Forever Security disclosed a class of vulnerabilities it calls Embrace (EMbedded BRowser) affecting Cursor, GitHub Copilot, Anthropic Claude Desktop, Microsoft VS Code and OpenAI Codex. All five tools grant their embedded browsers capabilities beyond those of a conventional browser, breaking the traditional web threat model. Impact ranges from arbitrary code execution (Cursor) and arbitrary local file read/data theft (Claude Desktop, Codex, VS Code) to address bar spoofing enabling phishing (GitHub Copilot). Researcher Gal Weizman says Cursor silently patched on 1 October and GitHub independently fixed Copilot in build 1.1.29 on 13 October, but OpenAI Codex and Microsoft VS Code issues remain unpatched, with Microsoft and Anthropic initially dismissing reports as "workspace trust" gated boundaries.
Entenda a falha
A vulnerabilidade
Forever Security calls a class of flaws 'Embrace' (EMbedded BRowser): five AI developer tools gave their embedded browsers powers beyond a normal browser. In Cursor, a page can call the agent's composer and inject hidden instructions, leading to command execution on the host. In Claude Desktop, VS Code and Codex, a local HTML file opened in the built-in browser can read arbitrary files. In GitHub Copilot 1.1.27, a page can spoof the address bar for phishing. Fixed: Cursor (silent patch, 1 Oct) and Copilot 1.1.29. Codex and VS Code are reported unpatched. No CVEs are given.
Como funciona
In Cursor, the integrated browser loads a page that is allowed to call the agent's composer. The agent reads the page's content as instructions and follows them, while the human user never sees them, so commands can run on the host. In Copilot's browser preview, some pages change their address without a new load, which the app cannot always see, so it lets the page report its own address. The app only checks that the text starts with http, https or file, then shows it in the address bar. In Claude Desktop and VS Code, a local page is limited to the project folders, but a web worker it starts is not subject to that limit and can reach any file. In Codex the limit does not exist.
Por que é vulnerável
The common root cause is that each tool enriched its embedded browser and so broke the normal web threat model: page content became trusted agent input, the page became the authority on its own address, or the page gained reach onto the host. Specific gaps: Cursor treats page-supplied content as instructions; Copilot validates only the URL's prefix and not where the tab really points; Claude Desktop and VS Code apply the folder restriction to pages but not to web workers; Codex has no restriction. Microsoft and Anthropic initially treated the reports as 'workspace trust' gated boundaries. The articles do not describe the fix details beyond Copilot's later build.
Como foi descoberta
Forever Security researchers, with Gal Weizman writing the report, found the flaws. They reported Claude Desktop to Anthropic on 23 July, which first rejected it as an invalid 'workspace trust' boundary; per Weizman, Noma Security reported the same flaw a day later and Anthropic accepted it. Codex went to OpenAI on 27 July with no response. Cursor was reported on 10 Sept and silently patched on 1 Oct with no advisory. VS Code was reported to Microsoft on 10 Sept and also labeled invalid. Copilot 1.1.27 was found on 26 Sept; GitHub fixed it in 1.1.29 on 13 Oct without a report from Forever. Details were published in a Thursday report.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 21:17.
Detalhes técnicos
- Cursor: the integrated browser lets a web page call the agent's composer; the agent treats page content as hidden instructions, enabling prompt injection that leads to command execution on the host. Disclosed 10 Sept, silently patched 1 Oct with no advisory.
- GitHub Copilot 1.1.27: browser preview lets the page declare its own address; the app only validated that the string began with http/https/file, allowing a spoofed
github.com/loginURL over a phishing page. Fixed in 1.1.29. - Claude Desktop / VS Code: local HTML files are restricted to project folders, but web workers bypass that restriction and can read any file on the machine.
- Codex: no such restriction at all — a local page can directly read arbitrary files.
Remediação
Update Cursor (post-1 October build) and GitHub Copilot to 1.1.29 or later. For Codex and VS Code, no fix exists: avoid opening untrusted local HTML files or untrusted repositories/workspaces in the built-in browsers, and treat embedded-browser content as untrusted agent input.
Linha do tempo
-
'Embrace' flaws in five AI developer tools enable RCE, file theft and URL spoofing; Codex and VS Code unpatched
ler a análise desta fonte ocultar
AI security startup Forever Security disclosed a class of vulnerabilities it calls Embrace (EMbedded BRowser) affecting Cursor, GitHub Copilot, Anthropic Claude Desktop, Microsoft VS Code and OpenAI Codex. All five tools grant their embedded browsers capabilities beyond those of a conventional browser, breaking the traditional web threat model. Impact ranges from arbitrary code execution (Cursor) and arbitrary local file read/data theft (Claude Desktop, Codex, VS Code) to address bar spoofing enabling phishing (GitHub Copilot). Researcher Gal Weizman says Cursor silently patched on 1 October and GitHub independently fixed Copilot in build 1.1.29 on 13 October, but OpenAI Codex and Microsoft VS Code issues remain unpatched, with Microsoft and Anthropic initially dismissing reports as "workspace trust" gated boundaries.
Technical Details
- Cursor: the integrated browser lets a web page call the agent's composer; the agent treats page content as hidden instructions, enabling prompt injection that leads to command execution on the host. Disclosed 10 Sept, silently patched 1 Oct with no advisory.
- GitHub Copilot 1.1.27: browser preview lets the page declare its own address; the app only validated that the string began with http/https/file, allowing a spoofed
github.com/loginURL over a phishing page. Fixed in 1.1.29. - Claude Desktop / VS Code: local HTML files are restricted to project folders, but web workers bypass that restriction and can read any file on the machine.
- Codex: no such restriction at all — a local page can directly read arbitrary files.
Remediation
Update Cursor (post-1 October build) and GitHub Copilot to 1.1.29 or later. For Codex and VS Code, no fix exists: avoid opening untrusted local HTML files or untrusted repositories/workspaces in the built-in browsers, and treat embedded-browser content as untrusted agent input.