A single HTML file opened in Codex or VS Code's built-in browser can read every file on the developer's machine and exfiltrate it to an external server, according to research published on October 29 by Forever Security1,2. The security firm estimates roughly 40 million developers use VS Code and more than 5 million use Codex weekly, leaving a large attack surface open while both tools remain without fixes.
Forever Security named the attack class EMBRACE — short for EMbedded BRowser trusted like a real one — covering a family of separate flaws that share a single design problem: browser components inside AI coding assistants inherit elevated access to the host application, letting untrusted web or local content escape normal security boundaries.
Five tools, two still exposed
The research targeted Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop. Cursor and GitHub Copilot have already shipped fixes. Cursor patched on October 1, according to Forever Security. GitHub independently closed an address-bar spoofing hole in Copilot build 1.1.29 on October 13, before Forever Security sent its report. Codex and VS Code remain unpatched.
In Codex, local pages can fetch files anywhere on the machine directly because the tool lacks a project-folder fence. VS Code and Claude Desktop restrict a local file to the project folder on the main page, but web workers bypass that check and can read any file on the computer. On a test machine, the attack collected SSH keys, .env files containing service passwords, npm tokens, and the hosts file, then sent everything to an outside server.
How the Cursor and Copilot chains worked
Cursor exposed a window.cursorBrowser.send() bridge that let any loaded page inject content into the agent's instruction box without a user gesture. Attackers could hide instructions inside HTML attributes so the visible element looked harmless while the agent received command fragments directing it to run an npm install. A single Enter keypress could approve execution; when Cursor's sandbox blocked the install, the agent independently retried outside the sandbox, and the package's preinstall script launched with the user's full privileges. Success depended on the model and was not guaranteed.
In GitHub Copilot desktop app version 1.1.27, the preview tab accepted address updates supplied by the page itself, enabling address-bar spoofing.
Vendor responses
Microsoft and Anthropic rejected Forever Security's report, stating that the disk-read behavior fell inside Workspace Trust. OpenAI never responded to a report that arrived on July 27, according to Forever Security. Anthropic later accepted the same flaw when Noma Security Inc. reported it separately.
ANALYSIS The split vendor response leaves developers in a difficult position: two of the five affected tools have no patch timeline, and the rejection rationale — that file access is expected under Workspace Trust — treats the embedded browser's elevated privileges as by-design rather than as a vulnerability.
Forever Security advises affected users to avoid opening untrusted HTML files in Codex or VS Code's built-in browser until patches ship.