EMBRACE flaws in Cursor, Copilot, Codex, VS Code and Claude Desktop: Codex and VS Code unpatched

What happened

Gal Weizman, a researcher at Forever Security, identified a class of flaws named EMBRACE (EMbedded BRowser, trusted like a real one) in five AI coding tools: Cursor, GitHub Copilot, OpenAI Codex, Visual Studio Code and Claude Desktop, according to Hackread. The Register reports that all five share one weakness: each tool gave its embedded browser capabilities beyond those of a conventional browser, which undermined the usual threat model. No CVE identifiers are given in either source.

The three abuse patterns reported:

• Cursor, code execution. A malicious web page can use a bridge between Cursor’s embedded browser and its AI assistant to inject hidden instructions into the command composer. In testing, the assistant ran an installation command that launched Calculator on the host. The command first hit a sandbox restriction, but the agent disabled it and retried. Hackread says the outcome depended on the model’s behavior (Hackread). The instructions stay hidden from the human user (The Register).
• GitHub Copilot, address-bar spoofing. In version 1.1.27, a page could change the URL shown in Copilot’s browser preview without navigating there, for example showing github.com/login while displaying an attacker-hosted page (Hackread). The Register adds that the app only checked that the text looked like an http, https or file address, not where the tab actually pointed.
• Codex, VS Code and Claude Desktop, file theft. Local HTML files opened in these apps could reach files outside the intended project boundaries. In VS Code and Claude Desktop, web workers bypassed directory checks enforced on the main page. Codex lacked the restriction, so a page could read files directly. Researchers demonstrated reading and exfiltrating SSH keys, developer tokens and private documents (Hackread).

Disclosure and patch status as reported:

• Cursor: reported September 10, patched October 1. Per The Register, Cursor published no advisory, did not respond to the researchers, and did not reply to The Register.
• GitHub Copilot: found September 26 and fixed independently by GitHub in 1.1.29 on October 13, without a report from Forever Security (The Register).
• Codex: reported to OpenAI on July 27 and unpatched at publication. An OpenAI spokesperson told The Register it is aware of the issue and working to address it.
• VS Code: reported to Microsoft on September 10. The Register says Microsoft labeled it an invalid workspace trust gated security boundary issue, and the researchers say it remains unpatched.
• Claude Desktop: reported to Anthropic on July 23 and initially declined as invalid for a workspace trust gated boundary. According to Weizman, Noma Security reported the same flaw a day later and Anthropic accepted that report as valid (The Register). Whether a fix has shipped is not confirmed.

Forever Security estimates that hundreds of millions of developers and users could be affected, citing about 40 million VS Code developers and more than 5 million weekly Codex users (Hackread). That figure is the researchers’ estimate. No exploitation in the wild is reported in the sources.

Am I affected?

You may be affected if developer machines in your organization run any of these tools:

• Cursor: versions before the October 1 patch are exposed. The fixed version number is not confirmed.
• GitHub Copilot: version 1.1.27 is confirmed vulnerable, and 1.1.29 contains the fix. The status of 1.1.28 is not confirmed.
• Codex and VS Code: reported unpatched at publication. The Register says developers using affected configurations are at risk, and the configurations are not further specified.
• Claude Desktop: vulnerable as reported, and fix status is not confirmed.

Exposure depends on the product. A single developer endpoint could expose accessible SSH keys, cloud credentials, developer tokens and source code, or allow code execution on the host (Hackread).

What to do now

1. Inventory these tools (Cursor, GitHub Copilot, Codex, VS Code, Claude Desktop) across developer endpoints, as Forever Security advises (Hackread).
2. Update Cursor to a build released on or after October 1, and GitHub Copilot to 1.1.29 or later.
3. As a precaution, avoid opening untrusted local HTML files in the built-in browsers of Codex, VS Code and Claude Desktop until vendors confirm fixes. This is a risk-reduction step, not a vendor-published mitigation.
4. Be cautious about letting AI agents browse untrusted pages inside Cursor, since hidden instructions from a page can drive the assistant.
5. Treat a Copilot browser preview address bar as untrusted for sign-in pages on affected builds, and update to 1.1.29.
6. Review the security controls governing embedded browsers in your developer tools, per Forever Security’s guidance.
7. If you suspect a malicious page or file was opened in an unpatched tool, rotate SSH keys, developer tokens and cloud credentials reachable from that machine.
8. Watch for vendor fixes from OpenAI, Microsoft and Anthropic. Their patch timing is not confirmed.

Sources

• Hackread: EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File Theft
• The Register: Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched