"Each tool enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model - as agent input, as the authority on a tab’s own address, or as reach onto the host," Forever researcher Gal Weizman wrote in a Thursday report.
Forever Security's "Embrace" class of vulnerabilities
Forever Security, an AI security startup, identified a set of related flaws across five AI developer tools and gave the weakness a collective name: "Embrace" (EMbedded BRowser). According to the company, all five affected products embed a browser component that has been granted capabilities beyond those available to conventional browsers. That common architectural choice, the researchers say, enabled four distinct exploit outcomes they observed: arbitrary code execution, arbitrary file reads (data theft), and address-bar spoofing.
Cursor: hidden agent instructions enable arbitrary code execution
Forever reported that Cursor’s integrated browser allows web pages to call the agent’s composer — a channel the agent treats as instructions and executes without surfacing them to a human operator. Because the instructions can remain hidden from users, the researchers say a prompt injection could cause the agent to run commands on the host machine. Forever disclosed this vulnerability to Cursor on September 10; Cursor silently patched the flaw on October 1, Forever says. Cursor did not publish a security advisory and did not respond to The Register’s request for comment, the report notes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleGitHub Copilot: address-bar spoofing found and later fixed independently
Forever found an address-bar spoofing issue in GitHub Copilot 1.1.27 on September 26. In normal browsers a page cannot change the text shown in the address bar without navigating; Copilot’s browser preview allowed a page to tell the app what address to display, and the app only validated that the text resembled a URL (starting with http, https, or file) rather than where the tab actually pointed. That gap could let a fraudulent page present a spoofed URL such as github.com/login while loading a phishing page beneath.
GitHub independently fixed the issue in Copilot build 1.1.29 on October 13 without receiving a vulnerability report from Forever, according to the research note. The Register reached out to GitHub and did not receive a response.
Claude Desktop, OpenAI Codex, and Microsoft VS Code: arbitrary file read via local pages and web workers
Forever found that Anthropic’s Claude Desktop, OpenAI’s Codex, and Microsoft’s Visual Studio Code allowed local HTML files opened inside their embedded browsers to access other files on the host.
- Claude Desktop and VS Code: The researchers say local pages could access their respective project folders in normal use, but web workers — background threads in the browser — could bypass those folder restrictions and reach any file on the machine. Forever disclosed the Claude Desktop issue to Anthropic on July 23; Anthropic initially declined the report as invalid for being gated by a "workspace trust" security boundary. Forever says Noma Security reported the same flaw a day later and Anthropic then accepted that report. Anthropic did not respond to The Register’s questions about the bug reports or Forever’s timeline.
- OpenAI Codex: Forever disclosed the Codex bug to OpenAI on July 27 and says it received no response. The team reports the Codex flaw remains unpatched and that a local page could read any host file directly without requiring a worker. OpenAI did not respond to The Register’s inquiries, including whether it planned to fix the flaw.
- Microsoft VS Code: Forever disclosed the VS Code vulnerability to Microsoft on September 10; the researchers say Microsoft labeled it as an invalid "workspace trust" gated boundary issue and that the flaw remains unpatched. Microsoft did not respond to The Register’s request for comment.
What this means for developers, vendors, and security teams
- Developers: Those using affected configurations can face risks ranging from data exfiltration to remote code execution, the researchers warn; Cursor’s patch demonstrates one remedial path, but Codex and VS Code remain reported as unpatched.
- Vendors (Anthropic, OpenAI, Microsoft, GitHub, Cursor): Forever disclosed four of the flaws to vendors; GitHub fixed Copilot without that disclosure, Cursor patched after disclosure, and Anthropic and Microsoft initially treated at least some reports as gated "workspace trust" issues before later acceptance in Anthropic’s case. OpenAI and Microsoft were reported as not responding to The Register. The vendors’ varied responses so far illustrate differing triage outcomes for embedded-browser issues.
- Security teams and defenders: The common root — enriched embedded browsers breaking usual browser threat models — suggests teams should verify whether embedded browser components in developer tooling enforce the same origin, worker, and local-file restrictions expected of conventional browsers, and track vendor advisories and build-level fixes cited by Forever (for example, Copilot 1.1.29).
Forever Security’s public disclosure frames Embrace as a pattern tied to design choices in modern coding assistants. Some vendors have patched or accepted reports; others, including OpenAI and Microsoft per Forever’s account, were reported as unpatched or disputing the report’s severity. The central unresolved fact left on the record is whether and when all vendors will close the remaining gaps Forever identified.
