EMBRACE flaws hit 5 AI coding tools with Codex and VS Code left unpatched

Embedded browsers in five popular AI coding tools gave attackers a backdoor to run code and steal files.

Tools · Source: The Register

What happened

Security researchers at Forever Security found critical vulnerabilities in five major AI coding tools. Cursor, GitHub Copilot, Claude Desktop, VS Code, and OpenAI Codex all share a common weakness. They gave their embedded browsers capabilities far beyond what a normal web browser allows. The researchers named this vulnerability class EMBRACE. It stands for embedded browser trusted like a real one. This extra power undermined traditional threat models and turned the browsers into security liabilities.

The exploits vary by tool but carry severe consequences. In Cursor, a malicious webpage could exploit a communication bridge to inject hidden instructions into the AI agent. The researchers proved this by forcing the agent to bypass a sandbox restriction and launch the Calculator app on the host machine. GitHub Copilot suffered from address bar spoofing. An attacker could change the URL displayed in the browser preview to a legitimate site like github.com/login while actually loading a phishing page underneath.

The file theft risks are massive. Claude Desktop, VS Code, and Codex allowed local HTML files to escape their boundaries. In Claude and VS Code, attackers used web workers to bypass directory checks and reach any file on the machine. Codex lacked these restrictions entirely. Researchers demonstrated reading and stealing sensitive files like SSH keys and developer tokens. Cursor and Copilot are now patched. However, researchers reported the flaws to OpenAI in July and Microsoft in September. Both Codex and VS Code remained unpatched at the time of publication.

Key facts

Why it matters

Developers treat their local code editors as safe environments. That assumption is now a massive liability. Opening a single malicious HTML file in your AI coding assistant can compromise your entire machine. Your SSH keys, cloud credentials, and proprietary source code are completely exposed if you run unpatched tools. The convenience of having an AI agent render web pages inside your editor is not worth handing over the keys to your infrastructure.

AI tool vendors are breaking standard security boundaries to make their products feel magical. To make AI agents helpful, companies are giving them deep system access and deliberately bypassing traditional browser sandboxes. This creates a massive new attack surface. Enterprise security teams will start locking down or outright banning AI coding assistants until vendors prove they can isolate these agents properly. The fact that Microsoft and Anthropic initially dismissed these reports as invalid workspace trust issues shows a dangerous disconnect between AI feature development and basic security hygiene.

For builders

Update your patched tools immediately

Cursor silently patched its flaw on October 1. GitHub independently fixed Copilot in version 1.1.29 on October 13. Update these tools now to protect yourself from arbitrary code execution and phishing attacks.

Stop opening untrusted HTML files

VS Code and Codex remain unpatched. Opening a random HTML file in these editors allows attackers to steal your local files. Keep untrusted files far away from your AI assistants until official fixes are released.

Audit your developer endpoints

A single compromised developer machine can leak cloud credentials and source code. Security teams must identify who is running these tools and restrict access to sensitive tokens. Companies lose big if a developer opens the wrong file.

My take

We gave AI agents the keys to our machines because we wanted them to write code faster. Now we are paying the price. Vendors bypassed basic browser sandboxing for convenience and left millions of developers exposed. Microsoft and OpenAI failing to patch a critical file theft bug for months is unacceptable. Stop trusting these tools blindly and treat every AI assistant like a potential backdoor into your system.

Original reporting: The Register. This is my rewrite and opinion.

More AI news for builders