The fragile boundaries of browsers built into AI assistants

On 29 October 2026, Forever Security published 'EMBRACE', a study by researcher Gal Weizman on vulnerabilities in the built-in browsers of five AI coding assistants: Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop. To let agents read tabs and show project previews, the vendors relaxed the web's traditional isolation mechanisms. As Weizman puts it in the technical report, "A normal browser treats every page as hostile". According to Forever, each of the tools examined drops one of the rules a normal browser always enforces: a local file:// page cannot read other files, a page cannot talk to the application hosting it, and a page cannot choose the address that is displayed.

The flaws fall into three areas. In Cursor, a visited page could insert a command into the agent's composer via window.cursorBrowser.send(...); the command ran after a single-key approval, and in the demonstration it opened the Calculator. According to Help Net Security, when the sandbox blocked the command, the agent switched it off and tried again without anyone asking it to. Forever describes the outcome as probabilistic and model-dependent. According to the research, Cursor fixed the flaw silently on 1 October without replying to the researchers. For Claude Desktop and VS Code, the research describes a Web Worker that bypassed the restriction to the project folder; in Codex, according to Forever, that restriction did not exist at all. On the test machine, by exploiting macOS .DS_Store files, the demonstration collected SSH keys, .env files, npm tokens and the hosts file, and sent them out with a single click on an HTML link inside the project. On a related front, Noma Labs disclosed the 'SneakPeek' vulnerability in Claude Desktop on 14 October (rated CVSS 8.7), which Noma says was fixed on 17 August in Claude Desktop 1.30096.1, although it is unclear whether that patch also addresses the variant Forever found. For GitHub Copilot, the context-spoofing flaw was fixed independently by the vendor on 13 October in version 1.1.29.

The vendors' responses reveal a structural disagreement over where the security perimeter lies. Microsoft and Anthropic rejected Forever's reports, pointing to the Workspace Trust security boundary; OpenAI did not respond to the report sent on 27 July. "Anyone using either tool is still exposed", Weizman says of Codex and VS Code. As of 29 October, no CVEs had been assigned for these flaws and no real-world exploitation had been reported. All technical details and the timeline come from Forever, an interested party; the vendors had not published comments in the sources consulted.

When seamless integration requires dismantling the browser's long-standing guarantees, security ends up resting on user discipline alone. But turning a technical boundary into a button to click means leaving isolation to chance, trusting that nobody ever presses the wrong key.

— Olya