Security startup Forever Security published research on October 29 describing a shared class of flaws it calls EMBRACE, short for EMbedded BRowser, in five AI developer tools: OpenAI's Codex, Anthropic's Claude Desktop, Microsoft's VS Code, GitHub Copilot and Cursor. In each case the tool's built-in browser was given powers a normal browser does not have, and those extras broke the usual browser security model.

The effects differed by product. In Cursor, a web page could send hidden instructions into the agent's composer, opening a path to running commands on the host machine. In Claude Desktop, Codex and VS Code, a local HTML file opened in the built-in browser could escape its project folder and read other files on the machine — in Codex's case directly, with no folder restriction at all, and in the other two by way of a web worker that the folder checks did not cover. In GitHub Copilot 1.1.27, a page could spoof the address bar, showing an address such as github.com/login over a fraudulent page underneath.

The patch picture is uneven. Cursor silently patched its flaw on October 1, three weeks after disclosure on September 10, and GitHub fixed the Copilot spoofing in version 1.1.29 on October 13, independently of the researchers. Forever says OpenAI has not patched the Codex flaw reported on July 27 — an OpenAI spokesperson told The Register it is aware and working on it — and that Microsoft labelled the VS Code report, sent September 10, an invalid workspace-trust issue and has not patched it. Anthropic first declined the Claude Desktop report in July, then accepted the same flaw when Noma Security reported it a day later.