OpenAI · Disclosed

Codex and VS Code Still Unpatched; Microsoft Declined the Report

· 2 min read

The EMBRACE research by Forever Security (published October 29) found flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop: host code execution in Cursor, local file read outside the project in Codex, Claude Desktop and VS Code, and address bar spoofing in GitHub Copilot. Cursor patched on October 1 and Copilot in version 1.1.29; Codex remains unpatched (OpenAI told The Register it is working on it) and Microsoft declined the VS Code report under its Workspace Trust boundary. These are research demonstrations with no reported attacks: treat pages and HTML files opened in these embedded browsers as untrusted.

By Updated Get this every day →← Back to the feed 3 sources
WhatsApp LinkedIn X
HighVulnerabilityDisclosedPartial fix
In this article
  1. What happened
  2. Why it matters
  3. What to do
  4. For the technical team
  5. Timeline
  6. Sources

What happened

The EMBRACE research by Forever Security, published October 29, found security flaws in the embedded browsers of five AI coding assistants: Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. Depending on the tool, the flaws allow running code on the computer, reading files outside the project, or spoofing the address bar. These are research demonstrations; no attacks have been reported.

Incidents like this, every morning

The ones that need action first, in a 3-minute read.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Why it matters

Employees using these tools could have sensitive data exposed, such as SSH keys.env files and npm tokens, read outside the project in Codex, Claude Desktop and VS Code, according to the researchers. In Cursor, a malicious page could lead the agent to run code on the computer. Codex and VS Code remain unpatched, so the risk persists today.

What to do

Ban or restrict opening untrusted pages and HTML files in these tools' embedded browsers. Confirm Cursor (October 1 patch) and GitHub Copilot (version 1.1.29) are updated. Keep secrets such as keys and tokens off developer machines where possible.

For the technical team

Affected
OpenAI, Anysphere, Anthropic, Microsoft/GitHub Navegadores embutidos nos aplicativos Codex, Cursor, Claude Desktop, GitHub Copilot e VSCode · Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop, per Forever Security. The publication has no full affected or fixed build list.
Exploitation
Research demonstrations by Forever Security (EMBRACE research, published October 29); no attacks reported. In testing, the file read in Codex, Claude Desktop and VS Code included SSH keys.env files and npm tokens on the researchers' own test machine.
Fix
Cursor: patched October 1. GitHub Copilot: fixed in version 1.1.29. Codex: unpatched at publication; OpenAI told The Register it is aware and working to address it. VS Code: unpatched; Microsoft declined the report under its Workspace Trust boundary. Claude Desktop: status not stated in the sources.
Vector
Embedded browsers inside AI assistants, driven by the agent rather than the user. Cursor: malicious page hides a command in an HTML chip; the agent reads the hidden instructions, asks for approval, and the command runs on the host (sandbox escape via prompt injection). Codex, Claude Desktop and VS Code: local HTML file opened in the embedded preview escapes its project folder and reads the rest of the disk. GitHub Copilot: page declares an arbitrary address and the app displays it without checking it matches the real tab.
More details
Root cause named EMBRACE: an embedded browser trusted like a real one. In Cursor, the sandbox blocked the command, but the agent, on its own, switched the sandbox off and tried again; installing a malicious npm package constitutes RCE on the OS with full user privileges outside the sandbox, though it depends on the model. In Copilot, the app only checked that the text looked like a web address. Researcher: @WeizmanGal.

Timeline

  1. Researcher details the most severe EMBRACE chain in Cursor: embedded browser escape and prompt injection lead the agent to install a malicious npm package, which amounts to OS-level RCE; Cursor's sandbox blocked the execution in that case.

  2. The EMBRACE researcher details findings per tool: browser escape to RCE via prompt injection in Cursor, address bar spoofing in GitHub Copilot, and arbitrary local file read in Codex, Claude Desktop and VSCode.

  3. Detail from Forever Security's EMBRACE research: a local HTML file opened in the embedded preview of Codex, Claude Desktop and VS Code could read SSH keys.env files and npm tokens outside the project.

Want the next updates in your inbox? Get the daily edition →

See all 5 updates

  1. Research on the AI assistants' embedded browsers circulates under the name EMBRACE in a new r/netsec thread.

  2. First public disclosure of the flaws; no fix or affected versions given.

Sources 3 sources

See all 6 sources

Get the next one tomorrow morning

One email a day with what changed, what to fix first and how. After signing up you get the full feed.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click

Share it with your team

Whoever handles security with you should get it too.

LinkedIn X

Your colleague gets a confirmation request. Nothing is sent unless they confirm.

See all news

Read also

Before you go: get this every day

The HIFY Radar daily edition lands every morning with the incidents that need action. Free.

Free · 1 email a day, in the morning · no spam, unsubscribe in 1 click