Illustration, AI-generated from the story text. Tap a panel to read the story through it.
Researchers at Forever Security reported that the browsers embedded in Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Anthropic's Claude Desktop were trusted like the computer behind them.
In Cursor a web page got the to run a hidden command.
In Copilot a page could show a genuine github.com/login address over a fake sign-in form.
In Codex, VS Code and Claude Desktop a single local file, opened with one click on a link the assistant wrote, could read keys, .env files and off the disk.
Forever calls the pattern EMBRACE.
The vendor record is uneven.
Cursor patched on October 1st, three weeks after disclosure, without replying.
GitHub fixed it in Copilot 1.1.29 before a report was filed.
Anthropic declined Forever's report but accepted a near-identical one from Noma Security a day later.
Microsoft declined, citing Workspace Trust, and OpenAI had not replied since July 27th; neither had a fix as of Thursday.
Built-in browsers in five AI coding tools could reach the files on a developer's machine
Researchers at Forever Security reported that the browsers embedded in Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Anthropic's Claude Desktop were trusted like the computer behind them. In Cursor a web page got the agent to run a hidden command. In Copilot a page could show a genuine github.com/login address over a fake sign-in form. In Codex, VS Code and Claude Desktop a single local file, opened with one click on a link the assistant wrote, could read SSH keys, .env files and npm tokens off the disk. Forever calls the pattern EMBRACE.
The vendor record is uneven. Cursor patched on October 1st, three weeks after disclosure, without replying. GitHub fixed it in Copilot 1.1.29 before a report was filed. Anthropic declined Forever's report but accepted a near-identical one from Noma Security a day later. Microsoft declined, citing Workspace Trust, and OpenAI had not replied since July 27th; neither had a fix as of Thursday. SourcesB
Sources
- BResearch: AI assistant browser vulnerabilities (Help Net Security)helpnetsecurity.com
This story ran in the Afternoon Brief of October 31st 2026.