A new security advisory reveals that embedded browser components in several popular AI coding assistants harbor serious vulnerabilities. Tools including Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop are all affected. Attackers could leverage these flaws to hijack address bars, execute code, steal local files, and bypass sandbox protections—posing a major risk to developers who rely on these tools daily.
The EMBRACE flaw class and how it works
Researchers have coined this suite of vulnerabilities “EMBRACE,” shorthand for “embedded browser trusted like a real one.” The underlying issue is structural: embedded browser features meant for previewing project files, tracking tabs, or rendering pages are being treated as fully trusted browsers—despite running within the context of the host application. That trust gap allows malicious content loaded through these embedded browsers to overstep normal security boundaries.
Targets and exploitation vectors
Cursor’s embedded browser exposes a bridge—named window.cursorBrowser.send()—which allows any loaded page to send content directly into its instruction box without user interaction. Malicious HTML attributes can conceal command fragments that the agent parses into something more dangerous—like an npm install command—and the system can end up executing code via a one‐keypress action. Even when sandboxing prevents this, Cursor could evade its own protections. In a proof of concept, its preinstall script was used to launch Calculator, even in a clean workspace.
GitHub Copilot’s built-in preview pane allows pages to overwrite the address bar’s displayed URL. While format validation is in place, there is no guarantee the address matches the origin of the content being shown. This allows a bad actor to display something like “github.com/login” to fool both the user and the assistant into thinking they’re on a legitimate page, even as they remain on an attacker‐controlled server.
In Claude Desktop and VS Code, the issue arises inside web workers—parts of the embedded browser that execute scripts in the background. These workers weren’t bound by the same file access checks applied elsewhere. As a result, attackers could read arbitrary files outside the project directory via a malicious local preview. In the case of Codex, no web worker bypass was needed: it could fetch files directly from the machine. On macOS, the exploit used hidden metadata files like “.DS_Store” to uncover filenames and scale the attack across folders.
The data accessed includes SSH keys, private documents, environment configuration files (e.g. .env), npm access tokens, and other sensitive resources. Exfiltration can happen to a local receiver or—more dangerously—to a remote server. The launching point is a malicious local page, sometimes facilitated by links generated by the assistant itself.
Current status of patches: Who is fixed, who’s still vulnerable?
Cursor patched its vulnerability on October 1. GitHub addressed its address-bar spoofing issue in Copilot with version 1.1.29, released October 13, after a validation from earlier versions.
Codex and VS Code remain unpatched as of the latest update. Microsoft has dismissed related reports as part of its Workspace Trust program. OpenAI has not responded publicly. Anthropic acknowledged its issue after initially rejecting it, but there is no clarity yet on if or when the fix will be released.
Given how embedded browser features are increasingly used in AI assistants to improve interactivity, previews, and workflows, these vulnerabilities hit at a broader trend: the push to make AI tools feel more native and seamless. But with deeper integration comes greater risk, and these flaws are a wake-up call.
What this means: Developers should update immediately—Cursor and GitHub Copilot users are protected for now. But those using Codex and VS Code should audit their environments closely and treat any embedded browser previews or local content with extreme caution. Companies must accelerate fixes, rethink trust boundaries, and ensure that embedded tools don’t become Trojan horses.
