Desktop coding assistants ship with a built-in browser so you can preview pages and let the agent use them. The Forever Security team showed that this browser gets powers a normal one doesn't have, and that breaks the threat model. Their research, called EMBRACE, affects Cursor, GitHub Copilot, Claude Desktop, Codex and VS Code.
What They Found: Three Classes of Flaw
According to The Register and Gal Weizman's technical write-up, the common finding is that each tool enriched its embedded browser beyond what a normal browser allows, and those additions undermine the traditional threat model: as input to the agent, as authority over a tab's address, or as access to the host. Forever Security, which The Register describes as an AI security startup, groups the flaws into arbitrary code execution (Cursor), arbitrary content exfiltration (Claude Desktop, Codex and VS Code) and arbitrary context spoofing (GitHub Copilot). None of the sources list CVE identifiers.
How Each Flaw Works
- Cursor: per the blog post, any page can call
window.cursorBrowser.send(...)and reach the agent's composer, with no user gesture. By splitting a command across hidden attributes of a fake "selected element" chip, the attacker gets around the agent's refusal; with auto-run on and an empty allowlist, it executes with a single Enter keypress. The proof of concept launched Calculator. Success is probabilistic and depends on the model. - GitHub Copilot: a page can report a fake URL to the preview's address bar; the app only checked that it started with http, https or file. Example: showing github.com/login on top of an attacker's page.
- Claude Desktop and VS Code: the project-folder boundary is enforced in the main document, but not inside a Web Worker. From there, local files can be read via file://, and the whole disk can be traversed thanks to .DS_Store files on macOS.
- Codex: per the blog post, it has no file-read barrier at all for the page, and a direct read returns any file on the machine.