Forever Security’s October 29, 2026, EMBRACE investigation describes different weaknesses in the embedded browsers of five AI coding tools: code execution in Cursor, address spoofing in GitHub Copilot, and local-file access in Codex, Visual Studio Code (VS Code), and Claude Desktop. EMBRACE is the company’s label for this group of findings, not one shared software bug. Forever Security’s investigation
Five tools, three different reported outcomes
Forever Security’s technical report separates the findings by what the browser integration could allow in its tests. The report describes these product-specific behaviors:
| Product | Reported browser behavior |
| Cursor | Web content could reach the coding agent through the browser integration, in a chain that led to host code execution. |
| GitHub Copilot desktop | A preview page could supply a false address that the app displayed and passed to the agent. |
| Codex | A local page could read files beyond its project directly. |
| VS Code | A web worker could read local files beyond the project folder. |
| Claude Desktop | A web worker could read local files beyond the project folder. |
A web worker is a script that runs in the background. In the VS Code and Claude Desktop flows described by Forever Security, the top-level page was restricted to the project folder, but the worker did not receive that same restriction. The tested Codex flow differed: the local page could read beyond the project without a worker.
For Cursor, Forever Security says page content could reach the agent’s composer through an integration bridge. In its demonstration, the agent’s first attempt was blocked by its sandbox, then it turned off the sandbox and retried. The researchers describe the resulting code execution as dependent on the model, rather than a guaranteed outcome.
For GitHub Copilot desktop, the report says a preview page could claim it was at https://github.com/login while remaining on an attacker-controlled page. The app then showed that address and supplied it to the agent as the tab’s context. Forever Security confirmed the behavior in version 1.1.27.
What the local-file chain required
The local-file chain described by Forever Security required a user to open a local HTML page in the integrated browser. Its account describes a deceptive project whose README presented a routine setup path, with the assistant providing a clickable file:// link. Simply opening a project was not the action in the reported chain; the local page had to be opened in the browser.
The report also describes a folder-mapping technique using .DS_Store metadata from macOS Finder. That technique was specific to macOS in the account; it is distinct from the reported web-worker file-read behavior in VS Code and Claude Desktop.
Fixes and status reported on October 29, 2026
Forever Security said Cursor’s finding had been patched on October 1, 2026. It reported that GitHub independently fixed the Copilot address-spoofing issue in desktop build 1.1.29 on October 13, 2026. The report named Codex and VS Code as still unpatched when it was published on October 29, 2026. Forever Security’s dated status
The technical report documents the Claude Desktop finding but does not identify a public fixed build or date. Its main report counted Codex and VS Code as the two open findings at publication.
