Built-in browsers in Codex and VS Code can expose local files; fixes still pending
Researchers found flaws in the embedded browsers of five AI coding tools. Cursor and Copilot are fixed; Codex and VS Code were still unpatched on October 29.
Security researchers at Forever Security published research on October 29, 2026 showing that the built-in ("embedded") web browsers in five AI-powered developer tools could be abused to run code or read files anywhere on a developer's computer. Cursor and GitHub Copilot have fixed their issues; OpenAI Codex and Microsoft VS Code were still unpatched at publication, and the status of Claude Desktop is unclear. When we re-checked on November 5, 2026, the researchers' technical write-up still listed the Codex and VS Code issues as open, and we found no fix or advisory from OpenAI or Microsoft. Until fixes ship, don't open local web pages or previews from projects you don't trust in Codex or VS Code.
What happened, in plain English
Many AI coding tools now include a small web browser inside the app. It lets a developer preview a web page they are building, open a documentation link, or let the AI assistant look at a page, all without switching windows.
A normal browser such as Chrome or Firefox follows strict rules. A web page cannot read files from your disk, cannot pretend to be another website in the address bar, and cannot send commands to other programs. The researchers, led by Gal Weizman, found that each of the five tools had given its built-in browser extra powers that a normal browser would never allow, and that those extras broke the usual rules. They named the problem class EMBRACE (from "EMbedded BRowser").
The problems differed by product:
- Cursor: a web page opened in the built-in browser could slip instructions to the AI assistant. That is called prompt injection: hidden text the AI treats as orders. In the researchers' tests, this could lead to code running on the computer.
- GitHub Copilot: a page could make the address bar show a fake address, for example a GitHub login page that was really a phishing site.
- Codex, VS Code and Claude Desktop: a local HTML file (a web page saved on disk, for example inside a downloaded project) could read other files on the computer, such as SSH keys (the keys used for remote logins) and
.envconfiguration files that often hold passwords and tokens.
An analogy: it's like a hotel key card that, besides your room, also happens to open the staff office. Each extra feature made sense on its own, but together they opened doors nobody meant to open.
The researchers say they know of no attacks in the wild, and no CVE (Common Vulnerabilities and Exposures) identifiers have been assigned.
Are you affected? What to do now
If you don't use any of these five tools, there is nothing to do. If you do, here is the status as reported by Forever Security on October 29, 2026:
| Tool | Problem | Status |
|---|---|---|
| Cursor | Web page → AI assistant → code execution | Fixed on October 1, 2026 (no advisory, no version number published) |
| GitHub Copilot app | Fake address bar | Fixed in build 1.1.29 (October 13, 2026); 1.1.27 was vulnerable |
| Claude Desktop | Local page could read any file | Anthropic accepted a report of the same flaw from Noma Security; fix status not stated publicly |
| OpenAI Codex | Local page could read any file | Unpatched at publication; OpenAI told The Register it is "aware of the issue and working to address it" |
| Microsoft VS Code | Local page could read any file | Unpatched at publication; Microsoft treated it as covered by Workspace Trust |
Checklist
- Find out which of these tools are installed on your machine or, for IT teams, across your fleet (software inventory, MDM or endpoint management).
- Update Cursor and the GitHub Copilot app to their current builds. For Copilot, make sure the build is 1.1.29 or later (check the About screen or your endpoint inventory).
- Update Claude Desktop to the latest version as a precaution.
- In Codex and VS Code, until fixes ship: do not open local HTML files, previews or
file://links that come from projects, repositories or downloads you have not reviewed. Be wary when an assistant offers a clickable local link while "setting up" an unfamiliar project from its README; the researchers describe a single click on such a link as enough. - Be careful with Workspace Trust. VS Code asks whether you trust a folder before enabling certain features. Microsoft points to that prompt as the security boundary, so answer "No" (Restricted Mode) for code you haven't reviewed, and review your list of already-trusted folders.
- Limit what a file-read bug can steal: keep long-lived secrets out of project folders and plain-text
.envfiles where you can, and use short-lived tokens. - If you opened an untrusted project in an affected tool and are worried, rotate the credentials that were stored on that machine: SSH keys, cloud and API keys, npm and Git tokens.
No official indicators of compromise have been published.
The expert view
Root cause. Every one of these products is a desktop app built on web technology (Electron or similar), with a browser surface bolted onto a host that holds far more privilege than a browser tab: file system access, a terminal, and an AI agent with tools. Browser security rests on a few strict boundaries — the same-origin policy, no access to the local file system, an address bar the page cannot control. Weizman's summary is that each tool "enriched its embedded browser beyond what a normal browser allows." Once you add a page-to-host bridge, or let a page report its own URL, or relax file-origin rules, the browser's threat model no longer holds, and the vendor now owns a security boundary it may not realise it created.
The attack chains, conceptually.
- Cursor: the built-in browser exposed a bridge to the AI composer to pages from any origin, without a user gesture. Page-supplied text appeared to the user as a barely visible chip but was read in full by the model. Combined with permissive auto-run settings, this turns a visited page into an indirect prompt injection with a path to command execution. The researchers note the outcome is probabilistic and depends on the model.
- Copilot app: the preview trusted the page's own report of its location, checking only that it looked like an
http,httpsorfileURL. That spoofs both the human (address bar) and the agent (which "knows" what site it is on). - Codex, VS Code, Claude Desktop: pages loaded from
file://were allowed to read other local files. In VS Code and Claude Desktop, the project-folder restriction applied only to the main document, and web workers (background scripts) were not fenced, so a worker could read beyond the project. Codex, per the researchers, applied no file-read fence at all.
Why the defenses failed. The VS Code and Claude Desktop reports were first rejected as being on the trusted side of a "Workspace Trust" boundary: if you trusted the folder, anything it does is your problem. That position is defensible on paper, but in practice developers trust folders all the time just to make their tools work, and AI assistants increasingly open and set up unfamiliar repositories for them. Anthropic later accepted Noma Security's report of the same Claude Desktop issue, which shows how inconsistently vendors draw this line.
Severity in context. No CVSS scores have been published. The file-read issues are serious for developer workstations, which typically hold SSH keys, cloud credentials and package-registry tokens, the same material behind October's wave of supply-chain and LLMjacking incidents. But exploitation needs a lure (a malicious project or local file) and at least one click, and no in-the-wild use is reported. "High for developers, low for everyone else" is a fair reading. The Cursor chain is the most dangerous conceptually, and it is fixed.
The broader trend. As with instruction files in Downloads and poisoned extensions, AI coding tools inherit old web and IDE attack surfaces and wire them to an agent that can act on them.
Still unknown. Fixed versions for Codex and VS Code; whether and when Claude Desktop shipped its fix; the exact Cursor build that contains the October 1 patch; and whether any CVEs will be assigned. Note that the research comes from a vendor that sells AI-tool governance products, and the product-level details have not yet been confirmed in advisories from the affected vendors.
Official sources
- Forever Security, Gal Weizman — EMBRACE: [Technical Overview] How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants (October 29, 2026)
- Forever Security — EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants (October 29, 2026)
- Coverage: The Register — Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched (October 29, 2026)
- Coverage: Hackread — EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File Theft (October 29, 2026)
- Coverage: Fleet — Codex and VS Code embedded browser local file read