A Security Firm Hacked the Browsers Inside Five AI Coding Tools

A Security Firm Hacked the Browsers Inside Five AI Coding Tools. Two Still Aren’t Patched.

Here is the uncomfortable shape of AI tooling in 2026: the assistants you trust with your source code are shipping their own web browsers, and nobody is holding those browsers to the rules that every real browser has followed for fifteen years.

That is not a metaphor. It is the literal finding. Forever Security, an AI security startup, spent the summer testing five of the most-installed AI developer tools on the market and found the same category of defect in every one. Researcher Gal Weizman’s writeup puts it plainly: each tool “enriched its embedded browser beyond what a normal browser allows, and those enrichments undermined the traditional threat model — as agent input, as the authority on a tab’s own address, or as reach onto the host.”

The company named the class Embrace. It is short for EMbedded BRowser. It is also, and this is not a coincidence anyone should miss, exactly what these tools were designed to do to you.

What the Five Tools Got Wrong

Normally a web page cannot run commands on your computer. That is the entire premise of the browser sandbox — JavaScript in a tab lives in a box, and the box has no door to your local applications. A normal page also cannot rewrite its own address bar, and a local HTML file cannot wander into other directories on your machine.

All five tools broke one of those premises, and each broke a different one.

Cursor — arbitrary code execution. Cursor’s integrated browser lets a web page call the agent’s composer. The agent treats that call as an instruction from you and follows it, and the instruction stays invisible in the interface. That is a prompt injection with a direct line to host command execution. Forever disclosed it to Cursor on September 10. Cursor silently patched on October 1 — and, according to the researchers, published no security advisory and did not respond to the disclosure. Cursor also did not answer The Register‘s request for comment.

GitHub Copilot — address bar spoofing. Copilot’s browser preview let the page tell the app its own address. The app checked only that the string started with http, https or file, and never verified where the tab actually pointed. Combine the two and you can display github.com/login in the address bar while loading a phishing page underneath it. Forever found it in Copilot 1.1.27 on September 26. GitHub shipped a fix in 1.1.29 on October 13 — independently, without ever receiving the report.

Claude Desktop, Codex and VS Code — arbitrary file read. All three let a local HTML file opened in the built-in browser escape its sandbox and read other files. Claude Desktop and VS Code restricted local pages to their project folders, but the restriction did not apply to web workers — the background-thread JavaScript feature. A local page starts a worker, the worker ignores the folder rule, and the worker reads whatever it wants. Codex had no restriction at all: a local page could read any file directly.

The disclosure history is where this stops being a technical story and becomes a vendor story.

Read the fourth row again. Forever reported the Claude Desktop flaw to Anthropic on July 23 and was told the report was invalid — it fell outside what Anthropic considered a security boundary, because it required “workspace trust.” One day later a different security firm, Noma Security, reported the same flaw. Anthropic accepted that one as valid. Anthropic did not answer The Register’s questions about either report or about Forever’s timeline.

That is the part of this story that should bother you more than the bugs. The bugs are ordinary software defects — embarrassing, but fixable. The triage is not. Two researchers described the same hole and got two different verdicts in forty-eight hours, which means the verdict was never about the hole.

Why This Is a Small Business Problem, Not a Developer Problem

A rational reaction here is: I do not use Cursor, I am not a developer, this is somebody else’s problem. Three reasons that is wrong.

One, AI coding tools are now how small business software gets built. The owner who hires a freelancer to build an ordering form, a booking widget, an inventory sheet — that freelancer is very likely working in Cursor or Copilot. The code arrives on your WordPress site either way. The threat model of the person you hired is your threat model.

Two, the same embedded-browser pattern is spreading to the tools you touch directly. AI assistants that read web pages on your behalf, agents that click through dashboards, and browser-based copilots all use a variant of the same architecture. The enrichment that made Cursor exploitable is the feature that makes an agent useful. You cannot have one without exposure to the other.

Three, the file-read flaws are the ones that should keep you up at night. A malicious local HTML file that can read any file on the machine is not a theoretical loss. Your browser saves passwords. Your desktop holds tax documents, bank statements, client contracts, and every API key anyone ever pasted into a notes app. Codex with no restriction at all means one opened file is one full-disk read.

And the volume context makes this worse, not better. Google Threat Intelligence Group’s analysis of January 2025 through August 2026 found monthly vulnerability disclosures rising from 5,045 in January 2026 to 10,740 in August — roughly a doubling — while high-risk disclosures grew 167 percent. Half of AI-discovered vulnerabilities result in remote code execution, against 26 percent for non-AI finds. Only 0.23 percent of disclosed vulnerabilities, about one in 431, were observed being exploited in the wild, which is the one genuinely reassuring number in the whole report.

Put those two datasets side by side and the picture is clear: discovery is accelerating faster than triage. When a vendor declines your class of bug as out of scope, the report does not disappear. It just stops appearing in the numbers.

The Disclosure Gap Nobody Is Measuring

There is a structural reason this keeps happening, and the Cloud Security Alliance put a name to it earlier this year: the “silent bounty.” Researchers report vulnerabilities to AI platform vendors and get no CVE, no public advisory, and no coordinated disclosure. The finding is real, the fix may even ship — Cursor patched silently on October 1 — and the public record shows nothing.

Silent patching is not nothing. A patched hole is better than an open one. But it removes the only signal that tells every other operator to go check whether their version is current, and it removes the incentive for the next vendor to do better. It also makes the aggregate data lie, because a flaw that was fixed without disclosure never enters the disclosed-vulnerability counts that everyone uses to reason about risk.

This is where small business owners get quietly hurt. You cannot patch what you were never told was broken, and you cannot audit a vendor’s security posture from a changelog that says “various improvements and bug fixes.”

What to Actually Do About It

The response to this research is not panic and it is not a product switch. It is a short list of habits that cost nothing.

Ask your AI tools two questions before you install them. Does this tool have an embedded browser, and can the pages it loads reach my local files or my terminal? If the answer is yes to either and there is no visible permission gate, that is a decision you should make knowingly rather than by default.

Update on a schedule, not on a memory. Cursor’s fix landed October 1 and the only way it reached users was people updating. Put a monthly calendar reminder to update every AI tool you run — the desktop assistants, the editor extensions, the browser copilots.

Never open local HTML files you did not create. This is the specific attack surface for the Codex, VS Code and Claude Desktop flaws. An emailed invoice, a downloaded “report,” a file from a client — if it is an HTML file and you open it in a tool with an embedded browser, you have handed that page your file system.

Move your secrets out of reach. Password managers with a locked vault, credentials in a proper secret store rather than a text file or a spreadsheet, and no API keys sitting in a notes app on the same machine as your AI assistant. The file-read class of bug only matters if the files are worth reading.

Watch the triage, not just the fix. When a vendor calls a bug report invalid, that tells you how they will treat the next one. A vendor that argues scope with a researcher is a vendor that will argue scope with you.

The Real Lesson: Enrichment Is the Vulnerability

Every single one of these five flaws exists because a vendor made a browser more than a browser. Cursor gave a page the ability to talk to an agent. Copilot let a page author its own URL. Claude Desktop, Codex and VS Code gave local files reach beyond their folder. None of these was a coding mistake in the ordinary sense. Each was a deliberate product decision that added capability and, with it, an attack surface.

That is what makes Embrace a durable story rather than a one-off bug round. The same trade is being made right now in every agentic product shipping a browser, and the trade is invisible to the buyer. You see an assistant that can “browse the web for you.” The security cost of that sentence is a browser that has been given powers your real browser is specifically designed never to have.

For a small business owner, the practical takeaway is not that AI tools are unsafe. It is that the convenience features are the ones carrying the risk, and the vendor who ships the most convenience is not the vendor who ships the most safety. Two of five vendors in this research still have an unpatched arbitrary file read, and one of those never replied at all.

So check your versions this week. Ask the question about embedded browsers before your next install. And when a vendor tells a researcher their finding is out of scope, remember that the next finding will get the same answer.

Frequently Asked Questions

What is the Embrace vulnerability?

Embrace is the name Forever Security gave to a class of flaws it found in the embedded browsers inside five AI developer tools. It stands for EMbedded BRowser. In each case the tool extended its built-in browser beyond the permissions a normal browser grants, which allowed code execution, file reading, or address bar spoofing depending on the tool.

Which AI tools were affected by the Embrace research?

Cursor, GitHub Copilot, Anthropic’s Claude Desktop, OpenAI’s Codex, and Microsoft’s VS Code. Cursor and Copilot were patched. The file-read flaws in Codex and VS Code remained unpatched as of the October 29, 2026 report, and Anthropic accepted the Claude Desktop report as valid only after a second firm submitted the same finding.

Are the Codex and VS Code flaws still unpatched?

As of The Register’s October 29, 2026 reporting, yes. Forever says Codex and VS Code remain unpatched. OpenAI told The Register it is aware of the issue and working to address it. Microsoft did not respond to a request for comment.

Is my business at risk if I do not use AI coding tools?

Indirectly, yes. Freelancers and agencies building your website or internal tools commonly use these editors, and their tooling becomes your exposure. The broader risk is the same architecture appearing in consumer-facing AI assistants with embedded browsers, which can read local files if a malicious page is opened inside them.

How do I protect myself from the file-read flaws?

Update all AI desktop tools immediately, never open HTML files you did not create inside an AI tool’s built-in browser, and move credentials into a locked password manager rather than text files. Once a page can read the disk, the only remaining defense is not having anything sensitive readable.

Why did Anthropic reject the Claude Desktop bug report?

Anthropic reportedly declined it as invalid because it fell outside a “workspace trust” gated security boundary. According to Forever, Noma Security reported the same flaw the next day and Anthropic accepted that report as valid. Anthropic did not respond to questions about either report or the timeline.

What does the Google data say about AI-discovered vulnerabilities?

Google Threat Intelligence Group found monthly disclosures roughly doubled through 2026, from 5,045 in January to 10,740 in August, with high-risk disclosures up 167 percent. Half of AI-discovered vulnerabilities lead to remote code execution versus 26 percent for non-AI finds. Only about one in 431 disclosed vulnerabilities was observed being exploited in the wild.