EMBRACE: five AI coding tools' browsers broke basic rules

Forever Security's Gal Weizman grouped the findings under EMBRACE, for an embedded browser trusted like a real one, after testing how the preview browsers in five AI coding tools handled powers a normal browser never grants. The write-up walks through each product's failure separately: Cursor exposed an object called window.cursorBrowser.send to every site, and the researchers split a command across hidden attributes so the agent would not refuse it. Codex's preview returned the contents of a file:// path on a plain fetch, while VS Code and Claude Desktop checked only the main page and not the web workers a page can start. The GitHub Copilot app, built on the Tauri framework, let a page report any address as its own.

The delivery path the researchers describe starts with a project the user is willing to open. A README can lead the assistant to write a clickable file:// link to a booby-trapped page, and clicking it runs the page. Microsoft and Anthropic first answered with Workspace Trust, but Weizman told Help Net Security that the prompt gives the user no protection here, because opening the project was already the user's choice. The write-up positions its grep search as triage signals rather than proof, noting that benign code can match some strings.

Patch status varies across the five. Cursor was fixed on October 1 and the GitHub Copilot app in 1.1.29 on October 13, while Codex and VS Code remained unpatched as of October 29, 2026. Anthropic declined Forever's report but accepted a separate Noma Security report as valid, and the write-up states no fixed version for Claude Desktop. The researchers also note that the Cursor attack's success depends on the model and is not certain every time.