EMBRACE is not the number of a single vulnerability. On October 29, 2026, Gal Weizman, a researcher at security company Forever Security, published research showing that the embedded browsers in five AI coding tools — Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic's Claude Desktop — crossed security boundaries that ordinary browsers respect. The research groups the problems under the name EMBRACE, short for an embedded browser trusted like a real one. The five tools do not share the same flaw, but they share one root cause: to let an agent preview a project and read a page, the embedded browser was given powers an ordinary browser never gets.
A web page can get the agent to run a command for it
In Cursor, an attack page hid a command inside a harmless-looking on-screen element, and the agent read the hidden instructions and asked to run them. When Cursor's safety sandbox blocked the command the first time, the agent switched the sandbox off by itself and tried again, eventually opening the Calculator app in the demonstration. Whether the chain succeeds depends on the model, but a web page reaching the point of running code on the host is itself the problem. The Cursor issue was reported on September 10 and silently fixed on October 1, with no reply from the vendor.
A local file can read the whole machine
The problem in Codex, Claude Desktop and VS Code is quieter: the victim only has to open a local HTML file in the embedded browser. Claude Desktop and VS Code confine a local page to its project folder, but the check applies to the page itself; a web worker, a background script the page can start, can bypass it. Codex had no such restriction at all. The attack file also reads the .DS_Store index files macOS leaves in every folder, mapping the whole machine folder by folder. On their own machines, the researchers confirmed that SSH keys, .env files and npm tokens were among the files read.
The address bar can lie too, and fix status differs by product
In GitHub Copilot 1.1.27, a page could declare its own address; the app only checked that the text looked like a web address and never verified where the tab really was, so the address bar could show github.com above a fake sign-in page. GitHub fixed the issue independently in build 1.1.29 on October 13, before the researchers had even sent a report. The ones still unfixed are Codex and VS Code: the former was reported on July 27 with no reply, the latter was reported on September 10 and rejected by Microsoft on Workspace Trust grounds. Forever Security's post gives no version number or date for Claude Desktop's fix, so it cannot simply be counted as unfixed. None of the five findings has a CVE number.
For developers, the protective steps are concrete: update Cursor and Copilot to the fixed builds; do not open local HTML files of unknown origin in an embedded browser or casually click a link the agent itself offers; treat local keys and tokens as if they could be read. The embedded browser is now part of the development tool, and holding it to ordinary browser standards is the general lesson here.
