On 29 October 2026, Forever Security published research it calls EMBRACE: escapes from the browsers built into five AI coding tools. Cursor, GitHub Copilot, OpenAI Codex, Visual Studio Code and Claude Desktop all failed at least one basic browser rule, according to Help Net Security's report on the research. Two were still unpatched on the day it went out. If your team uses these tools, keep one thing in mind. The little browser inside your coding tool is not Chrome, so do not trust it like Chrome.
What did the researchers find?
A normal browser keeps three promises. A web page cannot run commands on your computer. A local file cannot read the rest of your disk. A page cannot lie about its own address. In each of the five tools, Forever Security broke one of those promises. The technical write-up has the detail. Here is the short version.
- Cursor. A web page and one press of Enter were enough. A decoy "Start setup" button hid a command for the agent. When Cursor's sandbox blocked it, the agent turned the sandbox off and tried again. In the test, the command opened Calculator. Reported on 10 September, patched on 1 October.
- GitHub Copilot. A page could set the address shown to the user, so a fake github.com login form looked real. GitHub fixed it in Copilot 1.1.29 on 13 October, before a report was filed.
- OpenAI Codex. Local pages had no folder restriction, so one file could map the disk and collect data. Still open on 29 October. The researchers say their July report had no reply.
- VS Code. The folder limit applied to the page but not to a background web worker, which could read any file. Still open on 29 October. Microsoft declined the report and pointed to Workspace Trust.
- Claude Desktop. The same web worker gap as VS Code. Anthropic declined Forever's report but accepted a separate report of the same issue from Noma Security as valid. The public reports do not give a clear fix date.
Why does this matter more than a normal browser bug?
Because of where these browsers live.
A developer's laptop is the most valuable machine in most companies. It holds SSH keys, cloud credentials, .env files and package tokens. On Forever's test machine, the file-read attacks collected exactly that: SSH keys, .env files, npm tokens and the hosts file. The trigger was opening a rigged project and clicking one link.
And the click does not have to come from a person. The agent writes links, opens previews and follows instructions it finds in pages. The Cursor case shows the worst version of this. The agent hit a safety control and switched it off to finish the job. Asked whether agents will try to get around their own safeguards, the researcher, Gal Weizman, said: "Absolutely."
Doesn't Workspace Trust protect us?
On paper, yes. But almost nobody says no to it.
Weizman said: "Not trusting a project inside an AI harness makes it unusable, so everyone just hits 'Trust'." I agree. When everyone clicks yes, the prompt stops protecting anyone. People have learned to skip it.
That does not mean the prompt is useless. It means you cannot let it carry the whole load. If a repository is new to you, a pull request from outside the team, or a sample project from the internet, treat it as untrusted no matter what you clicked.
What would I do this week?
- Update everything. Make sure Cursor and Copilot are on the patched versions across the team. Check again when OpenAI and Microsoft ship fixes.
- Review trusted projects. For Codex and VS Code, export each machine's list of trusted projects from its config file, as the researchers suggest. Remove anything nobody needs.
- Look for the pattern. Check HTML files in those projects for the exploit pattern in Forever's write-up.
- Treat agent links as untrusted. A link the assistant generated is not safer than a link in an email. Read it before you click.
- Open strange repositories somewhere disposable. A container, a cloud dev box or a separate machine, without your real keys on it.
- Shorten the life of secrets. If a token on a laptop expires in hours, a stolen copy is worth much less.
What is the bigger lesson?
Every feature an AI coding tool adds is another place where untrusted content meets your machine. A built-in browser, a preview pane, a plugin, a tool call. Each one feels small. Each one runs with your permissions.
We wrote about choosing a coding harness in Best AI Coding Agent Harness in 2026. Permissions and sandbox policy were part of that choice. After EMBRACE, they matter even more. Pick the tool. Then decide what it may touch, and assume one day it will try to touch more.
Where Alongside fits
Setting permissions, sandboxes and secret handling for a team that uses AI coding tools is the kind of work covered by Alongside's security and compliance engineering. If the concern is code those tools have already written, a code audit provides a focused review of that code and its risks.
