{"id":"TECH-202610-built-in-browsers-in-ai-coding-assistants-cursor-github-copi","kind":"technique","aliases":[],"related":[],"title":"Built-in browsers in AI coding assistants (Cursor, GitHub Copilot, Codex, VS Code, Claude Desktop) let a web page or local file run code, read the whole disk or fake the address bar; Codex and VS Code unpatched (EMBRACE)","description":null,"summary":"Forever Security (Gal Weizman, 2026-10-29) found that the browsers built into five AI coding assistants do not keep normal browser security rules. In Codex, VS Code and Claude Desktop, a local HTML file opened in the built-in browser can read any file on the disk and send it out. In VS Code and Claude Desktop it does this through a web worker, which skips the project-folder check; Codex has no check at all. Their test pulled SSH keys, .env files and npm tokens. The bait is a normal-looking repo: the user asks the assistant to set it up per the README, and the assistant gives the user a clickable link to the file. In Cursor, a page in the built-in browser hid instructions that the agent ran on the host after one Enter, and the agent turned off its own sandbox to do it. In GitHub Copilot 1.1.27, a page could make the address bar, and the agent's list of tabs, show any address, e.g. github.com. Status: Microsoft declined to fix VS Code and OpenAI has not answered on Codex, so both are still exposed. Cursor was quietly patched on 2026-10-01 (version unknown), Copilot was fixed in 1.1.29 and Claude Desktop's report was accepted (fixed version unknown). This is a proof of concept; no attacks in the wild are reported. Developer laptops running these tools are at risk.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Codex","fixed":[],"affected":"all versions as of 2026-10-29","ecosystem":"desktop"},{"name":"VS Code","fixed":[],"affected":"all versions as of 2026-10-29","ecosystem":"desktop"},{"name":"Claude Desktop","fixed":[],"affected":"unknown","ecosystem":"desktop"},{"name":"Cursor","fixed":[],"affected":"before the 2026-10-01 patch","ecosystem":"desktop"},{"name":"GitHub Copilot","fixed":["1.1.29"],"affected":"1.1.27","ecosystem":"desktop"}],"ecosystems":[],"tags":["ai-tooling","early-warning","technique"],"not_affected_if":[],"how_to_check":"- List developer machines running Codex, VS Code (built-in browser or preview), Claude Desktop, Cursor or GitHub Copilot.\n- Check GitHub Copilot builds; 1.1.27 is confirmed affected and 1.1.29 is fixed.\n- Look for cloned repos whose README asks the assistant to open a local HTML file in the built-in browser.\n- Watch for outbound connections from the assistant's browser process during project setup.\n- Cursor and Claude Desktop fixed versions: unknown.","fix":"- Update Cursor, Claude Desktop and GitHub Copilot (1.1.29 or later) to the latest builds.\n- In Codex and VS Code (no fix), do not open local HTML files from untrusted repos in the built-in browser, and do not click links the assistant offers to files in those repos.\n- Open untrusted repos only in VS Code Restricted Mode / without Workspace Trust, or in a disposable VM or container that holds no SSH keys or cloud credentials.\n- Do not approve agent run commands that come from web page content, and do not let the agent turn off its sandbox.","status":"open","published_at":"2026-10-29T00:00:00+00:00","first_seen_at":"2026-10-29T15:08:14+00:00","triaged_at":"2026-10-29T15:08:14+00:00","updated_at":"2026-10-29T15:08:14+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-01':273B '-10':75B,272B '-202610':42A '-29':76B '1.1.27':227B '1.1.29':280B '2026':74B,271B 'accept':287B 'address':33A,233B,244B 'agent':205B,215B,237B 'ai':6A,48A,64B,84B 'ai-tool':63B 'answer':258B 'ask':169B 'assist':8A,86B,171B,181B 'assistants':50A 'attack':298B 'bait':160B 'bar':34A,234B 'browser':4A,80B,91B,111B,200B 'browsers':46A 'built':2A,44A,81B,109B,198B 'built-in':1A,108B,197B 'built-in-browsers-in-ai-coding-assistants-cursor-github-copi':43A 'check':142B,146B 'claud':15A,99B,127B,282B 'claude':58A 'clickabl':186B 'code':7A,14A,25A,38A,57A,85B,97B,125B,253B 'codex':12A,35A,55A,95B,143B,260B 'coding':49A 'concept':296B 'copi':53A 'copilot':11A,62A,226B,276B 'could':230B 'cursor':9A,51A,60A,192B,266B 'declin':249B 'desktop':16A,59A,100B,128B,283B 'develop':304B 'disk':29A,118B 'e.g':245B 'earli':67B 'early-warn':66B 'embrac':40A 'embrace':54A 'enter':212B 'env':154B 'expos':265B 'fake':31A 'file':23A,104B,115B,155B,190B 'five':83B 'fix':251B,278B,288B 'folder':141B 'forev':70B 'found':77B 'gal':72B 'github':10A,52A,61A,225B 'github.com':246B 'give':182B 'hid':201B 'host':209B 'html':103B 'in':45A,47A 'instruct':202B 'keep':89B 'key':153B 'laptop':305B 'let':17A 'link':187B 'list':239B 'local':22A,102B 'look':165B 'make':231B 'microsoft':248B 'normal':90B,164B 'normal-look':163B 'npm':157B 'one':211B 'open':105B 'openai':255B 'page':20A,194B,229B 'patch':269B 'per':176B 'project':140B 'project-fold':139B 'proof':294B 'pull':151B 'quiet':268B 'ran':206B 'read':26A,113B 'readm':178B 'repo':166B 'report':285B,303B 'risk':311B 'rule':93B 'run':24A,306B 'sandbox':220B 'secur':71B,92B 'send':120B 'set':173B 'show':242B 'skip':137B 'ssh':152B 'status':247B 'still':264B 'tab':241B 'tech':41A 'techniqu':69B 'test':150B 'token':158B 'tool':65B,308B 'turn':216B 'unknown':275B,290B 'unpatch':39A 'user':168B,184B 'version':274B,289B 'vs':13A,37A,56A,96B,124B,252B 'warn':68B 'web':19A,134B 'weizman':73B 'whole':28A 'wild':301B 'worker':135B","nicknames":["EMBRACE"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-built-in-browsers-in-ai-coding-assistants-cursor-github-copi","url":null,"severity":null,"published_at":"2026-10-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-29T15:08:14+00:00","fetched_at":"2026-10-29T15:08:14+00:00","note":null}],"documents":[{"id":17065,"url":"https://x.com/_r_netsec/status/2115814251659165786","title":"@_r_netsec: EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants ·","kind":"post","source":"x","publisher":null,"text":"EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Secur https://t.co/BdYNSgJNAd\n\nlikes 2 reposts 3","published_at":"2026-10-29T14:33:22+00:00","relation":"describes","confidence":null,"note":null},{"id":17194,"url":"https://www.reddit.com/r/netsec/comments/1xilm92/embrace_how_we_hacked_the_browsers_embedded_in/","title":"r/netsec: EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Secur","kind":"post","source":"reddit","publisher":null,"text":"EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Secur\n\nsubmitted by /u/Content-Winter5328 [link] [comments]","published_at":"2026-10-29T14:31:39+00:00","relation":"describes","confidence":null,"note":null},{"id":17249,"url":"https://forever.security/blog/embrace","title":"EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants (Forever Security)","kind":"blog","source":"analyst","publisher":null,"text":"Forever Security (Gal Weizman), 2026-10-29. Built-in browsers in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop break browser rules. Cursor: page hides instructions in HTML chip, agent runs command on host with one Enter, agent disabled its own sandbox; silently patched 2026-10-01 (version not given). GitHub Copilot 1.1.27: page spoofs address bar (e.g. github.com) to user and agent; fixed in 1.1.29 (2026-10-13). Claude Desktop and VS Code: local HTML file opened in built-in browser starts a web worker that reads any file on disk (project-folder check skipped for workers); Codex has no restriction at all. Uses macOS .DS_Store files to map the disk; exfiltrated SSH keys, .env, npm tokens. Delivery: a repo with README, user asks assistant to set it up, assistant offers clickable link to the local file. Disclosure: Anthropic accepted (via Noma Security); OpenAI no response, Codex unpatched; Microsoft declined (Workspace Trust), VS Code unpatched. Original link resolved via https://t.co/BdYNSgJNAd; exact canonical URL on forever.security not confirmed.","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}