Built-in browsers in AI coding assistants (Cursor, GitHub Copilot, Codex, VS Code, Claude Desktop) let a web page or local file run code, read the whole disk or fake the address bar; Codex and VS Code unpatched (EMBRACE)

Forever Security (Gal Weizman, 2026-10-29) found that the browsers built into five AI coding assistants do not keep normal browser security rules. In Codex, VS Code and Claude Desktop, a local HTML file opened in the built-in browser can read any file on the disk and send it out. In VS Code and Claude Desktop it does this through a web worker, which skips the project-folder check; Codex has no check at all. Their test pulled SSH keys, .env files and npm tokens. The bait is a normal-looking repo: the user asks the assistant to set it up per the README, and the assistant gives the user a clickable link to the file. In Cursor, a page in the built-in browser hid instructions that the agent ran on the host after one Enter, and the agent turned off its own sandbox to do it. In GitHub Copilot 1.1.27, a page could make the address bar, and the agent's list of tabs, show any address, e.g. github.com. Status: Microsoft declined to fix VS Code and OpenAI has not answered on Codex, so both are still exposed. Cursor was quietly patched on 2026-10-01 (version unknown), Copilot was fixed in 1.1.29 and Claude Desktop's report was accepted (fixed version unknown). This is a proof of concept; no attacks in the wild are reported. Developer laptops running these tools are at risk.

Summary written from the sources below. Check the originals before acting.