Researcher Gal Weizman of Forever Security has disclosed a class of flaws called EMBRACE in the built-in browsers of five AI developer tools: Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop. Codex and VS Code remained unpatched as of October 29.
What EMBRACE Means for Embedded Browsers
The name stands for EMbedded BRowser, trusted like a real one. Weizman found that the browsers built into these tools are granted more capabilities than a normal browser, and that the tools trust them accordingly.
Results differed by product. Cursor ran attacker code. Copilot showed a spoofed address. Codex, VS Code and Claude Desktop let a single local file read the rest of the disk.
Cursor and GitHub Copilot Fixes Shipped in October
Cursor was reported on September 10 and patched on October 1. GitHub fixed Copilot on its own in version 1.1.29 on October 13, without having received a report.
Unpatched Flaws in Codex and VS Code
Codex and VS Code remained unpatched as of October 29, the date of public release. Opening a rigged project in either tool could expose SSH keys, cloud credentials and developer tokens, according to the research.
The risk comes from a malicious or compromised project containing a file that the embedded browser can use to read other files on the disk. Developers routinely open repositories from outside sources, which is the situation the research describes.
Claude Desktop in the Affected Group
Claude Desktop is listed among the affected tools, with the same class of behavior as Codex and VS Code: a single local file reading the rest of the disk. The reporting separates the tools by patch state, naming Codex and VS Code as the two still unpatched.
Scale of the Affected User Base
Forever Security estimates hundreds of millions of users are in scope. It cites VS Code at about 40 million developers and Codex at more than 5 million weekly users. These are the researcher’s estimates, not vendor figures.
EMBRACE Impact on Developer SSH Keys and Cloud Tokens
The central risk is theft of developer credentials from untrusted projects. SSH keys, cloud credentials and developer tokens are the assets named. The reporting describes the risk as dependent on a user opening a rigged project; it does not describe any attack in the wild.
A Pattern of Trust in Embedded Components
The EMBRACE class groups together flaws that share a root cause rather than a single bug. Each tool embeds a browser to render content such as previews or sign-in pages, and each gives that component privileges beyond what a standalone browser would hold. The different outcomes, from code execution in Cursor to address spoofing in Copilot to disk reads in three others, reflect how each product wired up its embedded browser.
The disclosure timeline varies. Cursor’s roughly three-week gap between the September 10 report and the October 1 patch contrasts with GitHub’s unprompted fix for Copilot on October 13. OpenAI and Microsoft had not shipped fixes for Codex and VS Code by the time of publication, which left the two tools with the largest cited user numbers exposed. Developers using the patched Cursor and Copilot builds are covered, while the guidance for the remaining tools is to update when fixes arrive and to avoid opening untrusted projects in unpatched Codex and VS Code.
Forever Security’s Estimates Versus Confirmed Vendor Fixes
The user figures come from Forever Security, not from the vendors. VS Code at about 40 million developers and Codex at more than 5 million weekly users are the two numbers cited, and the firm’s estimate of hundreds of millions covers all five tools. Cursor’s and GitHub’s fixes are confirmed by dates and, for Copilot, a version number, 1.1.29. The reporting gives no fix dates or versions for Codex or VS Code, whose flaws were still open on October 29, the day the research became public.
