Forever Security took aim at the small browser window most AI coding tools now embed and found a shared design flaw running through five of them.
The startup’s researchers, Gal Weizman among them, describe the class as Embrace, for embedded browser. Each product enriched its built-in browser beyond what a normal browser permits, and those additions broke the assumptions the threat model was built on. An ordinary web page cannot run commands on a host machine because its JavaScript cannot reach local apps.
What each product got wrong
Cursor’s browser lets a page call the agent’s composer. The agent reads that as instructions and follows them while the user sees nothing, which is prompt injection with host execution as the payoff. Cursor patched it quietly on October 1 after a September 10 report, publishing no advisory.
GitHub Copilot took the page’s word for its own address, checking only that the text looked like a URL. A malicious site could therefore display github.com/login while serving a phishing page underneath. GitHub fixed it in version 1.1.29 on October 13 without ever receiving a report.
Claude Desktop, VS Code and Codex all let local HTML opened in the built-in browser escape its boundary. In Claude Desktop and VS Code the project-folder restriction did not extend to web workers, so a worker thread could reach any file. Codex had no such restriction at all.
Still open
OpenAI acknowledged the Codex bug is unpatched and said it is working on it. Microsoft rejected the VS Code report as a workspace-trust boundary issue and the researchers say it remains unfixed. Anthropic first called the Claude Desktop report invalid, then accepted an identical finding from another firm a day later.
