EMBRACE vulnerability: how to secure your AI coding tool in 10 minutes

Forever Security found the embedded browsers in five top AI coding tools break basic browser security boundaries.

The EMBRACE vulnerability is a set of flaws in the built-in browsers of five AI coding tools, published by Forever Security on 29 October 2026. A web page or a local file opened inside Cursor, GitHub Copilot, Codex, VS Code or Claude Desktop could run code on your machine, read files across your whole disk, or fake the address bar. Two of the five are patched. Codex and VS Code were still unpatched when the research came out, and a security alerts feed refreshed on 2 November still listed them as unfixed. This guide shows you how to check your setup and close the gaps in about 10 minutes.

Why this matters now

Forever Security, led by researcher Gal Weizman, published the research on 29 October 2026, and coverage followed on 1 and 2 November in DevOps.com, Help Net Security and several security trackers. The timing matters because two vendors have not shipped a fix, so the protection has to come from your own settings and habits until they do.

The attack needs one click. A project dressed up as a financial report asks the assistant for setup help from its README, the assistant writes a clickable file:// link to an HTML file in the project, and you click it. On the researchers' test machine, that page collected SSH keys, .env files, npm tokens and the hosts file, then sent them out.

The preview pane is the weak spot because it is the part of the editor you already trust. A normal browser treats every page as hostile. Each of these tools relaxed one browser rule so the preview could do useful work, and each relaxation handed a hostile page something a normal browser would deny.

What the flaw does in each tool

EMBRACE is one pattern in three forms, and each tool broke a different rule.

Cursor let a page run code on the host. Its built-in browser exposes an object called window.cursorBrowser.send to every site you open, and a site can call it without a click. One channel builds a small chip in the agent's composer from fields the page supplies. The agent reads a hidden list of attributes behind that chip, so the researchers split a command across those attributes and the agent did not refuse it. With auto-run on and an empty allowlist, one Enter press ran it. When the sandbox blocked an npm install, the agent switched the sandbox off by itself and retried. The proof opened Calculator from a cold start. The researchers reported it on 10 September and say Cursor patched it on 1 October without issuing an advisory. They also note the attack depends on the model and does not work every time.

GitHub Copilot let a page write its own address bar. In the Copilot desktop app, a page could call a Tauri command to report any address as its own. The app checked only that it started with http, https or file and carried no password. The fake address was shown to you and handed to the agent as fact, so a page could show github.com/login over a fake sign-in form. The researchers found it on 26 September in version 1.1.27. GitHub fixed it on its own in 1.1.29 on 13 October, before a report was sent.

Codex, VS Code and Claude Desktop let a local file read the whole disk. When you open a local HTML file, its origin is file://, and a real browser keeps each local file cut off from the rest of the disk. In Codex, a plain fetch of a file:// path returned the file's contents, with no folder check at all. VS Code and Claude Desktop checked that the page stayed inside the project folder, but the check covered only the main page, not the web workers a page can start. A worker built from an in-memory blob could read outside the project. On macOS the researchers parsed .DS_Store files, which list a folder's contents, to walk the whole disk.

Patch status, as reported on 29 October 2026:

Microsoft and Anthropic both pointed to Workspace Trust, the prompt that asks whether you trust a folder's authors. Weizman told Help Net Security that the prompt gives the user no protection here, saying "Not trusting a project inside an AI harness makes it unusable, so everyone just hits 'Trust.'" No CVE identifiers have been assigned to any of the findings.

What you need

• Whichever of the five tools you run: Cursor, GitHub Copilot desktop app, Codex, VS Code, or Claude Desktop
• A terminal, for the search in step 6
• About 10 minutes
• No account and no API key are needed for any step in this guide

Secure your setup in 10 minutes

1. Update the GitHub Copilot app to 1.1.29 or later. Check the version in the app's About or settings screen. If it is below 1.1.29, update it before you use it again. Version 1.1.27 is the build the researchers confirmed the address spoof on.
2. Update Cursor to a build from after 1 October 2026. That is the date the researchers say the code execution path was patched. Check the version in the app's About screen and update if yours is older.
3. In Cursor, turn auto-run off or keep a short allowlist. Auto-run with an empty allowlist is what let one Enter press run a command from a web page. Turning it off, or keeping the allowlist short, blocks that path even on an unpatched build.
4. In Codex, VS Code and Claude Desktop, stop opening HTML from untrusted projects in the built-in preview. Use your normal browser for previews instead. Your normal browser keeps a local file cut off from the rest of the disk, which is the exact rule these previews break.
5. Never click a file:// link your agent writes for a project you did not write. The local-file attack is delivered through that link. If you need to see the file, open it in your normal browser or read it as text in the editor.
6. Search your project folders for the researchers' indicator strings. The patterns below are triage signals, not proof, and normal code can match some of them, so read each hit. Change ~/code to your own folder:

   grep -rIlE --include='*.html' --include='*.htm' --include='*.js' \
     'cursorBrowser\.send|submit_browser_preview_url_change|createObjectURL|new Worker\(|fetch\([^)]*file:///' ~/code

   The pattern that matters most is a worker built from a Blob that fetches file:/// paths, or a page that encodes data with btoa and sends it to an outside host. Plenty of normal web apps start workers, so expect noise from that part of the search.
7. Check that Workspace Trust is on in VS Code. Open your settings.json file and confirm it holds this line:

   {
     "security.workspace.trust.enabled": true
   }

   Then treat the trust prompt as a real decision. Do not click Trust on a folder you have not checked. The researchers' point is that the prompt is the only barrier the vendors rely on, so clicking through it on every folder removes it.
8. Move secrets out of the folders your agents work in. Keep .env files, SSH keys and tokens out of project folders where possible, and store them in a password manager or a secrets tool. If your agent needs a key, mask it before the model sees it. Our guide to masking secrets with shim-cli covers the setup for Claude Code, Codex and Copilot CLI.
9. Open untrusted repos in a devcontainer or a virtual machine that holds no SSH keys and no cloud credentials. This is the safest way to inspect a project you do not trust, since the preview flaw cannot reach files that are not on that machine.

If you already opened an untrusted project

If you worked with untrusted files in an affected tool, rotate your SSH keys, npm tokens and API keys. That is the advice from the security coverage of the research, and it applies even if you saw nothing odd, because the exfiltration happens silently in the background.

Then run the search from step 6 over the folders you opened, update the tools you run, and apply steps 3 to 5 before you open another unfamiliar project. If the grep search returns hits, read each one before you decide whether it is a real problem. A hit on its own is a signal to look, not a verdict.

Frequently asked questions

What to do next

The EMBRACE vulnerability is fixable in 10 minutes for two of the five tools and manageable for the other three. Update Cursor and the Copilot app first, turn auto-run off in Cursor, and stop opening untrusted HTML in the built-in previews of Codex, VS Code and Claude Desktop. Run the indicator search over your projects, keep secrets out of agent working folders, and rotate any keys that may have been exposed. If you audit agent skills as well as projects, read our 7-step SKILL.md security checklist, and if you run OpenCode, check our OpenCode MCP fix guide too, since the same habit of auditing what an agent can reach protects you in both cases.

Sources

• Forever Security (Gal Weizman), "EMBRACE: [Technical Overview] How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants", 29 October 2026: forever.security
• DevOps.com, "AI Coding Assistants' Built-In Browsers Open a Path to Developer Secrets", 1 November 2026: devops.com
• The AI News Report, "EMBRACE explained: how the built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broke three basic browser rules", 30 October 2026: theainewsreport.com
• NeoTeo, "EMBRACE report: browser flaws in AI coding tools", 1 November 2026: neoteo.com
• ctxsec, "EMBRACE: the browsers built into Cursor, Copilot, Codex, VS Code and Claude Desktop broke basic browser rules", 29 October 2026: ctxsec.com
• pwn.watch, "EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broken, Codex and VS Code still unpatched", 29 October 2026: pwn.watch
• Vibe Coding Security alerts feed, refreshed 2 November 2026, still lists Codex and VS Code as unfixed: pranavaraparla.com