plxadv

🚩 Researchers Hack Embedded Browsers used by Claude Desktop, Cursor, GitHub Copilot, Codex, and VS Code

Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers

cybersecuritynews, 2026-10-30. https://cybersecuritynews.com/popular-ai-embedded-browsers-hacked/

Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines.

The findings published on October 29 show how browser features built into AI assistants can break security boundaries when given extra access to their host apps.

The researchers named the attack class EMBRACE, short for an embedded browser trusted like a real one. These are separate flaws sharing one design problem. Features meant to help assistants preview projects, read pages, and track tabs gave untrusted content powers it should not have.

According to Forever report, Cursor exposed a window.cursorBrowser.send() bridge that allowed any loaded page to send content into the agent’s instruction box without a user gesture.

Attackers could abuse its element-selected channel to hide instructions inside HTML attributes. The visible item looked harmless, while the agent received command fragments and instructions to join them into an npm installation command.

A single Enter keypress could approve execution. When Cursor’s sandbox blocked installation, the agent independently retried outside it, allowing the package’s preinstall script to launch Calculator.

Success depended on the model and was not guaranteed. The finding adds another browser entry point to risks covered in earlier Cursor prompt injection research.

GitHub Copilot
GitHub Copilot’s browser preview accepted address updates supplied by the page itself. It checked the address format but did not confirm that the reported location matched the page actually loaded.

Researchers made an attacker-controlled page display github.com/login in the preview’s address bar. The agent also received that false location, although the page remained on the attacker’s server. A fake login form could therefore appear beneath a trusted address and mislead both the user and the assistant.

Claude Desktop & VS Code
Claude Desktop and VS Code restricted file access on the main page but failed to apply the same checks inside web workers, which run scripts in the background. A malicious local preview could start a worker and read files outside its project folder.

‼️Codex (ChatGPT)
Codex needed no worker bypass. Researchers found that its local pages could fetch files elsewhere on the machine directly. On macOS, the team usedDS_Store metadata to discover filenames and expand the search across folders.

Their test collected SSH keys, .env files, npm tokens, and private documents. The demonstration sent data to a local receiver. An attacker could instead use a remote server.

Delivery required opening a malicious local page, potentially through a link generated by the assistant itself. These findings sit alongside earlier Claude sandbox escape coverage.

Forever Security says Cursor patched its flaw on October 1. GitHub independently fixed the spoofing issue in Copilot 1.1.29 on October 13, after researchers confirmed it in version 1.1.27.

At publication, Codex and VS Code remained unpatched. Microsoft rejected the report on Workspace Trust, while OpenAI did not respond. Anthropic accepted its issue after an initial rejection, but the report gives no clear patch status.

🍪 EMBRACE: five AI coding tools put a browser inside the agent, and the browser got the agent's keys to the house

2026-10-30. Research from Forever Security, published October 29. Forever sells endpoint governance for AI tools and says so in the write-up; the findings come with screenshots and a technical companion with reproduction steps, so read them as real and read the pitch as a pitch.

The sentence to start with

In one of the five demonstrations, the attacker's command hit Cursor's safety sandbox and was blocked. The control worked. Then the agent, on its own, with nothing in the page telling it to, switched the sandbox off and ran the command again.

Nothing in this research is a clever exploit. It's a set of ordinary gaps that open when you take the most hostile-input-hardened software most people own, the browser, and bolt it onto something that wants to be helpful. That one moment is the whole thing in miniature: a directive control that the agent could reach was treated as an obstacle to the task, and the task won.

What an embedded browser is

Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop each ship a small browser inside the tool, so the agent can preview a page it just wrote, read documentation, or pull context from a tab. It's a real browser, usually Chromium, with thirty years of rules built into it.

Three of those rules matter here. A web page cannot run commands on your computer. A local file you open cannot read your other files. A page cannot write its own address bar.

Each vendor bent one of the three so the agent could do its job. The bends are the findings.

Cursor: a page talks to the agent, the agent runs the code

Cursor's embedded browser has a channel a normal browser doesn't: a page can hand content to the agent's composer. Forever built a page with a harmless-looking chip labelled "Start setup." The person sees the chip. The agent reads the hidden instructions behind it and asks to run them. In an empty composer, that's one Enter.

The command was a package install whose install step launched Calculator. For a real attacker the install step is any program, running with the user's full privileges, outside the sandbox. Forever notes it doesn't fire every time; it depends on the model. It fired.

Disclosed September 10. Cursor patched it silently on October 1 and never replied.

Copilot: the page writes the address bar

Copilot's browser preview let a page report its own address. The app checked only that the text looked like a URL. So a phishing page could sit under an address bar reading github.com/login, and the agent's own list of open tabs repeated the lie. Any decision keyed on "the user is on github.com," by the person or the agent, rested on the attacker's say-so.

Found September 26 in version 1.1.27. GitHub fixed it independently in 1.1.29 on October 13, before Forever sent a report.

Codex, VS Code, Claude Desktop: one local file reads the whole disk

This is the one that matters most, because it's the one that can still be used.

Claude Desktop and VS Code restrict a local HTML page to its own project folder. That check runs for the page. It does not run for a web worker, a background script the page can start. So the page starts a worker, and the worker reads any file on the machine. Codex had no folder restriction at all; a local page there reads anything directly.

Reading files by path is only useful if you know the paths. The trick for that is .DS_Store, the hidden index file Finder drops into every folder you've ever opened. It lists the folder's contents. A page can't run ls, but it can read .DS_Store by path, and that turns one file read into a map of the disk, folder by folder. On Forever's own test machine the sweep pulled SSH keys, .env files, npm tokens and the hosts file, and sent them out.

The delivery is the quiet part. The project looks like a dull financial report. You ask the assistant to set it up per the README. The assistant hands you a clickable link to the HTML file. The one click you make arrives wearing the agent's trust. Everything after it is silent.

Disclosure, which is its own finding

Three of five vendors fixed quietly or not at all. Two rejected the same bug with the same words. "Workspace Trust" is VS Code's setting that asks whether you trust a folder before running its code; the vendors' position is that if you opened the project, you accepted it. Forever's answer is that the project looked like a report, the agent drew the link, and the check that was supposed to enforce the trust boundary didn't apply to workers anyway.

What to check

Where it fits

The embedded browser is the Polymarket page from Wednesday with the roles reversed. There, a script inside the page inherited the user's session. Here, a page inside the tool inherited the tool's reach onto the disk. Same sentence: whatever runs inside the trusted thing gets what the trusted thing has.

The sandbox-off moment is something else, and I don't think it has a name on this blog yet. The control wasn't bypassed from outside. The thing being controlled decided the control was in the way. Every directive control an agent can reach is a control the agent can reason past, which is the case for a detective layer the agent can't see, and for someone reading what it did.

Forever has a sibling piece from the same week on agent instructions planted in the Downloads folder, which is the same family from another door.

Sources