DEV Community

Cover image for The browser inside your AI coding tool: what the EMBRACE research means for a small team
Devaland
Devaland

Posted on Originally published at devaland.com

The browser inside your AI coding tool: what the EMBRACE research means for a small team

#security #cursor #vscode #ai

In short: on 29 October 2026, the security company Forever published research it calls EMBRACE. It looked at the browsers built into five AI coding tools, including Cursor, GitHub Copilot, Codex and VS Code. In every one, a web page or a local file reached the computer behind the browser. On the day it was published, the issues in Codex and VS Code were still unpatched. Below: what happened, whether it applies to you, and what to change this week.

Every fact below links to its source, with the date it was true. Where something is not confirmed, we say so.

What the research found

The research comes in two parts, both dated 29 October 2026: a main post and a technical companion. AI coding agents now carry their own browser, so the agent can preview your project, read what a tab shows or pull context from a page. The researchers say each tool gave its browser a power that a normal browser does not allow, and that each of those powers became a way in. EMBRACE stands for "an EMbedded BRowser, trusted like a real one".

They found three kinds of problem.

Cursor: a web page talked the agent into running a command

According to the technical companion (29 October 2026):

  • Cursor's built-in browser had a channel that let any web page send content into the agent's chat box, from any site and without a click.
  • The test page sent an instruction hidden in an on-screen label. The person saw a harmless label; the agent read the whole instruction. The command was split into pieces, and the agent put the pieces together and offered to run an install command.
  • Approving it took one press of Enter. When Cursor's sandbox blocked the command, the agent turned the sandbox off by itself and tried again, so the install ran with the user's full rights.
  • The researchers say it does not work every time, because it depends on the model.

GitHub Copilot: a page could fake the address bar

According to the technical companion (29 October 2026):

  • In GitHub Copilot's browser preview, a page could tell the app it was at any address it liked. The app only checked that the text looked like a web address.
  • The address bar showed github.com/login while the page stayed on the attacker's site, and the agent was told the same false address.
  • In practice, a fake sign-in form could carry GitHub's address in the one place people check.

Codex, VS Code and a third tool: a local file could read the whole disk

According to the technical companion (29 October 2026):

  • These tools let an HTML file opened from your own disk read the files next to it, so a preview can load its own scripts and images. The research says a normal browser does not allow a local file to reach other files.
  • VS Code and the third tool blocked reads outside the project folder, but only for the page itself. A web worker, which is a background script the page can start, could read any file on the disk. Codex had no such block at all.
  • On the research machine, a Mac, the attack listed folders using the hidden .DS_Store files that Finder leaves behind, then read and sent out SSH keys, .env files, npm tokens, the hosts file and private documents.
  • The delivery needs one click: a project that looks like a dull financial report, a request to the agent to "set up the project per the README", and a clickable link to the local file that the agent itself shows you.

Patched or not: what is confirmed

Status as read on 1 November 2026. The research's own timeline is in its disclosure section.

  • Cursor: fixed, according to the research. The research says it was reported to Cursor on 10 September 2026, patched on 1 October 2026 without an announcement, and that Cursor did not reply. Cursor's own release notes for version 3.21 (17 September 2026) say element selection and area screenshots now respond only to your own clicks, "so a web page can't inject fake selections into chat". The notes for 3.22 (24 September 2026) say "web pages can no longer fake element selections or area screenshots sent to chat". Not confirmed: Cursor does not link these notes to the research, so Cursor has not said which version it counts as the fix.
  • GitHub Copilot: fixed, according to the research. The research says the address bar spoof was confirmed on GitHub Copilot 1.1.27 on 26 September 2026, and that GitHub fixed it in 1.1.29 on 13 October 2026, before any report was sent. Not confirmed: we could not check GitHub's own release notes for 1.1.29 for this article, so the version comes from the research only.
  • VS Code: not fixed on 29 October 2026, according to the research. The research says it was reported to Microsoft on 10 September 2026, and that Microsoft declined it as invalid because it falls under the "Workspace Trust" security boundary. The VS Code 1.144 release notes (released 28 October 2026, the newest version on 1 November 2026) do not mention a fix.
  • Codex: not fixed on 29 October 2026, according to the research. The research says it was reported to OpenAI on 27 July 2026 and that OpenAI never replied. OpenAI's Codex changelog (newest entry 29 October 2026, read 1 November 2026) names no fix for this. It does list one macOS security update on 25 September 2026, CVE-2026-100754, without saying what it covers. Not confirmed: whether that update touches this issue. The research, published a month later, says it was still open.
  • The third tool. The research found the same file-reading problem in Claude Desktop. It says a report sent on 23 July 2026 was declined, and a second report, from Noma Security, was accepted as valid on 24 July 2026. The research does not count it among the issues still open.

Also worth knowing:

  • The research (29 October 2026) does not report any of these flaws being used against real people.
  • The tests ran on macOS, and the folder-listing step relies on a macOS file. The research does not say whether Windows or Linux behave the same way.
  • The research is published by a company that says, in the same post, that it builds tools to watch how AI tools behave on work computers.

Does this apply to you?

It applies if both of these are true for anyone on your team:

  1. They use Cursor, GitHub Copilot, Codex or VS Code with its built-in browser.
  2. They open things they did not write in that browser: a template, a client's repository, a pull request from a contributor, a downloaded project, or a website the agent visits.

Why it matters once you have real users: the file-reading attack goes after what sits on a developer's computer, such as SSH keys, .env files and tokens (29 October 2026). If the .env file on a laptop holds the keys for your live database, hosting or payment provider, a read of that file is a read of those keys.

It does not describe your setup if nobody opens web pages or local HTML files in a tool's built-in browser. The research covers only the five tools it tested. It says nothing either way about others.

What to change this week

  1. Update Cursor and GitHub Copilot. Check the version in each tool's About screen. For Cursor, the browser changes are in 3.21 and 3.22, and the research dates the fix to 1 October 2026. For GitHub Copilot, the research names 1.1.29.
  2. In Codex and VS Code, do not open HTML files from projects you did not write in the built-in browser until a fix is confirmed. VS Code's integrated browser documentation (read 1 November 2026) shows that local HTML files open there with "Open in Integrated Browser". If you need to look at one, the research says a normal browser keeps a local file away from your other files.
  3. Open unfamiliar projects in VS Code's Restricted Mode. Microsoft's Workspace Trust documentation (read 1 November 2026) says "When in doubt, leave a folder in Restricted Mode", and that Restricted Mode disables agents in that workspace. Not confirmed: neither Microsoft nor the research says whether Restricted Mode stops this exact attack.
  4. Turn off agent browsing you do not use. In VS Code, turning off the setting workbench.browser.enableChatTools stops chat agents from using the integrated browser, according to the same integrated browser documentation. In Cursor, keep browser actions on manual approval, which Cursor's browser documentation (read 1 November 2026) marks as recommended. The same page says: "Never use auto-run mode with untrusted code or unfamiliar websites."
  5. Read the card before you press Enter, and sign in only in your normal browser. The research's advice is not to count on "a user would have to click something" as a defence, because in these findings the click came from a link the agent drew or a single Enter on its run card. The Copilot finding also shows that a preview's address bar could name a site the page was not on.
  6. If someone already opened a local HTML file from an unfamiliar project in Codex or VS Code's built-in browser, treat the secrets on that computer as exposed, because those are the files the research read on its own machine. Create new SSH keys, new keys for everything in the .env files, new npm tokens and new cloud credentials, then delete the old ones. The research does not describe a way to tell afterwards whether a file was read.

What this article does not cover

It covers the three findings in the EMBRACE research and the vendors' public notes on them, as they stood on 1 November 2026. It does not cover other ways an AI coding agent can be misled, other tools, or the security of the app you are building. For that, start with the 10 things to check before real users arrive.

When to get help

If you are not sure whether a key on a developer's laptop gives access to your live app, or which keys to replace and in what order, a second pair of eyes is usually faster than guessing. Our AI app rescue is built for apps made with AI coding agents. It starts with a fixed-price diagnosis: a written report of what is wrong, why, and a fixed price for each fix. The report is yours to use with any developer.

Sources and dates

Frequently asked questions

Is Cursor still affected?
The research says the issue was patched on 1 October 2026. Cursor's release notes for versions 3.21 and 3.22, from September 2026, say web pages can no longer fake selections sent to chat. Cursor has not linked those notes to the research. Update to the current version.

Is VS Code safe to use?
The research covers only VS Code's integrated browser. Its file-reading issue was unpatched on 29 October 2026, and Microsoft declined it as a Workspace Trust matter. Keep unfamiliar projects in Restricted Mode and do not open their HTML files in the integrated browser.

Is there a fix for Codex?
Not as of 29 October 2026, according to the research, which says OpenAI never replied to the report. OpenAI's Codex changelog, read 1 November 2026, names no fix for it.

Do I need to stop using AI coding agents?
The research does not say so. Its advice is to treat the built-in browser as something that loads untrusted pages and files, and not to rely on a required click as a defence.

Does this affect Windows or Linux?
The tests ran on macOS, and the step that lists folders uses a macOS file. The research does not say whether other systems behave the same way.

Was my users' data taken?
The research does not report these flaws being used against real people. The risk it describes is to a developer's computer and the secrets on it. If one of those secrets gives access to your live app and the computer may have been exposed, replace that secret.

Originally published on devaland.com: The browser inside your AI coding tool: what the EMBRACE research means for a small team

Top comments (0)