EMBRACE: built-in browsers in Cursor, Copilot, Claude Desktop, Codex and VS Code could run code or read local files

On October 29, 2026, Forever Security researcher Gal Weizman published EMBRACE, a set of findings about the web browsers built into AI coding tools. These panels let the agent and the developer preview pages without leaving the editor, but the research found that they can expose bridges to the agent or to local files that a normal browser would never give a web page. No CVEs have been assigned, and as of November 5 we found no vendor advisories about these findings.

In Cursor, a hostile page opened in the integrated browser could place instructions in the agent's command composer; with one Enter keypress the agent ran a command on the host, and the researchers' test launched Calculator. They say Cursor patched it on October 1 without replying to their report. In GitHub Copilot's browser preview, version 1.1.27, a page could make the address bar show a different site, such as a fake github.com login; GitHub fixed it in 1.1.29 on October 13, before the researchers filed a report.

The third finding is a file read. A local HTML file opened in the embedded browser of Codex, VS Code or Claude Desktop could use a web worker to read files outside the project, including SSH keys, .env files and tokens. The victim has to open that file, which an agent can be tricked into suggesting. The researchers report that OpenAI did not respond to their July 27 report and that Microsoft declined the VS Code report, citing Workspace Trust; both were unpatched at publication. Anthropic first declined the report, then accepted it as valid after Noma Security reported it, and no fix status has been published.