Five AI coding tools had a browser you could break, and two were still open on Thursday
The short answer
Security researchers found flaws in the browsers embedded inside five AI coding tools: Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. A rigged web page or a local HTML file could run code, fake the address bar, or read files outside the project. As of 29 October, Codex and VS Code had no fix, so opening a malicious project in either could expose SSH keys and credentials.
What the flaw is
The research, published by Forever Security and reported by Hackread and Help Net Security, names the class EMBRACE, for embedded browser trusted like a real one. The idea is simple: these tools now ship a small browser inside the editor so a model can read documentation or preview a page. That browser was treated as trusted, so a page could do things a normal web page cannot.
In Cursor, a page got attacker code to run. In Copilot, a page could show a fake address bar, which makes phishing trivial. In Codex, VS Code and Claude Desktop, a single local HTML file opened inside the tool could read files beyond the project folder, which is how SSH keys and environment files leave a machine.
Why it matters to a normal developer
Most people who use these tools do exactly what the attack needs: they clone a repository, open it, and let the assistant read the folder. If a project contains a crafted HTML file, the file is inside the trusted boundary the moment the workspace is opened.
The timing was poor. Codex and VS Code had no fix as of 29 October. Researchers reported the Codex issue to OpenAI on 27 July and the VS Code issue to Microsoft on 10 September. Anthropic and Microsoft declined the reports and pointed at Workspace Trust, the prompt that asks you to confirm you trust a folder.
What to do now
Treat a cloned repository the way you treat an email attachment. Open it in a throwaway environment first, especially if it came from a stranger or a contest. Do not click trust on a folder you have not looked inside.
If you use Codex or VS Code, pull the list of trusted projects from each machine's config and check whether any project in that list contains an HTML file you did not write. Rotate any key that was present on a machine where you opened an untrusted project.
Questions people are asking
Which tools are affected?
Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. The flaws are in the embedded browser each one uses, not in the models.
Is there a fix?
Cursor, Copilot and Claude Desktop had fixes by the time the research was published. As of 29 October, Codex and VS Code did not.
Do I need to stop using these tools?
No, but change the habit. Do not open untrusted repositories directly in an editor with an AI assistant attached, and do not blanket-trust folders.
What could actually be stolen?
Anything readable from your user account: SSH keys, cloud credentials, environment files with API keys, and source code outside the project folder.
Why did two vendors refuse the report?
Anthropic and Microsoft argued that Workspace Trust already gates the risk. The researchers disagree, since the trust prompt is exactly what a malicious project wants you to click.
Sources
Forever Security, EMBRACE technical write-up, 29 October 2026 · Hackread, 29 October 2026 · Help Net Security, 29 October 2026.