How the built-in browsers in five AI coding tools broke basic browser rules

On October 29, 2026, Forever Security published EMBRACE, research showing that the browsers built into five AI coding tools could run commands, read the whole disk or fake the address bar. We explain the three rules a normal browser keeps, put the five products and their patch status in one place, and turn the researchers' indicators into one search you can run across your projects.

A normal browser keeps three promises. A web page cannot run programs on your computer. A local file opened in the browser cannot read your other files. And only the browser writes the address bar, so the address you see is the page you are on.

Forever Security's Gal Weizman calls the broken versions EMBRACE, for an embedded browser trusted like a real one. Each of the five tools tested broke one promise: Cursor broke the first; Codex, VS Code and Claude Desktop broke the second; the GitHub Copilot app broke the third.

Cursor's built-in browser exposes an object, window.cursorBrowser.send, to every site you open, and a site can call it without a click. One of its channels, element-selected, builds a small chip in the agent's composer from fields the page supplies.

The chip looks harmless on screen, but the agent reads a hidden list of attributes behind it. The researchers split a command across those attributes so the agent would not refuse it. With auto-run on and an empty allowlist, one Enter press ran it.

When Cursor's sandbox blocked npm install, the agent cancelled the block itself, so a package's preinstall script ran with full rights. The proof opened Calculator from a cold start. The researchers say success depends on the model and is not certain every time.

They reported it on September 10 and say Cursor patched it on October 1 without replying.

When you open a local HTML file, its origin, the identity a browser uses to decide what a page may touch, is file://. Real browsers keep each local file cut off from the rest of the disk. The researchers found that in Codex's preview a plain fetch of a file:// path returned the file's contents.

VS Code and Claude Desktop did check that the page stayed inside the project folder. But the check covered only the main page, not web workers, the background scripts a page can start. A worker built from an in-memory blob could read outside the project. On macOS the researchers parsed .DS_Store files, which list a folder's contents, to walk the whole disk.

On their test machine this collected SSH keys, .env files, npm tokens and the hosts file.

In the Copilot app, a page could call a Tauri command (Tauri is the app framework) to report any address as its own. The app checked only that it started with http, https or file and carried no password. The fake address was shown to you and handed to the agent as fact.

The researchers found it on September 26 in version 1.1.27. GitHub fixed it on its own in 1.1.29 on October 13, before a report was sent.

The local-file attack starts with a project you are willing to open, such as a folder dressed up as a financial report. It hides one line that loads a script like sw.js. When you ask the assistant to set the project up from its README, it may write a clickable file:// link. You click it, and the page runs.

Microsoft and Anthropic first answered with Workspace Trust, the prompt that asks whether you trust a folder's authors. Weizman told Help Net Security that the prompt gives the user no protection here, because opening the project was already the user's choice.

Forever lists strings that are triage signals, not proof, and benign code can match some of them. This search covers the ones you can grep for in HTML and JavaScript under a folder of repositories. Change ~/code to your own folder:

grep -rIlE --include='.html' --include='.htm' --include='*.js'
'cursorBrowser.send|submit_browser_preview_url_change|createObjectURL|new Worker(|fetch([^)]*file:///' ~/code

Then read each hit. The pattern that matters is a worker built from a Blob that fetches file:/// paths, or a page that encodes data with btoa and sends it to an outside host. Plenty of normal web apps start workers, so expect noise from that part of the search.