The EMBRACE vulnerability is a set of flaws in the built-in browsers of Cursor, GitHub Copilot, Claude Desktop, OpenAI Codex and VS Code. Security startup Forever Security says a bad web page or local HTML file can run code, spoof a link, or read files outside your project. If you use any of these tools, the short answer is: update, and don’t open untrusted pages inside them.
Here’s the short version before the details:
- Five tools are affected: Cursor, GitHub Copilot, Claude Desktop, Codex and VS Code.
- Cursor was patched on October 1, and Copilot was fixed in build 1.1.29 on October 13.
- Codex and VS Code were still unpatched when the research went public on October 29, according to the researchers.
- The risk is stolen SSH keys, tokens and source files, or code running on your machine.
Those are the headlines. The rest of this post explains what actually broke and what to do about it.
Why the EMBRACE vulnerability starts with a built-in browser
Many AI coding tools now ship a small browser so the agent can preview your app or read a page. That browser isn’t a normal one. It has extra hooks so the agent can see and control what’s on screen.
According to The Register, that extra power is the shared root cause. The browser can do things Chrome or Safari would never allow, so a page that behaves badly in a tab can do real damage here.
Coding agents also already hold your credentials and file access. A rendered web page becomes a way to reach all of it.
What broke in each tool
Each product failed in a slightly different way. This table sums up what the researchers reported.
| Tool | What went wrong | Status (as reported Oct 29) |
|---|---|---|
| Cursor | A page could pass hidden instructions to the agent and trigger code execution | Patched Oct 1, no advisory |
| GitHub Copilot | A page could fake the address shown in the preview, enabling phishing | Fixed in 1.1.29 on Oct 13 |
| Claude Desktop | A local HTML page could use a web worker to read files outside the project | Unclear in reports |
| OpenAI Codex | A local page could read any file, with no project-folder limit | Unpatched, per researchers |
| VS Code | Same web worker trick as Claude Desktop | Unpatched, per researchers |
The pattern matters more than the individual bugs. Three tools leaked files, one allowed code execution, and one allowed spoofing.
In the Cursor demo, the page’s hidden instructions made the agent run a command that opened Calculator. Hackread notes the result depended on how the model behaved, so it isn’t guaranteed every time.
What an attacker could actually take
The file-read bugs are the scariest. The researchers showed they could read and send out files like SSH keys and developer tokens.
That could also expose cloud credentials and source code. One affected laptop could be enough to open a door into your company.
The catch is that the attacker needs you to open their page or file inside the tool. It’s not a remote attack that works on its own. That’s why the advice below is mostly about habits.
It’s the same family of risk we covered in the AGENTS.md attack, where a hidden file in your Downloads folder tried to steer a coding agent.
Who’s fixed it and who isn’t
Vendor replies were thin. Cursor didn’t answer the researchers or The Register, and GitHub didn’t answer The Register either.
Anthropic first rejected the Claude Desktop report as outside its “workspace trust” boundary. A day later it accepted a matching report from Noma Security as valid. The Register says Anthropic didn’t answer its questions, so check the release notes for a fix.
Microsoft reportedly called the VS Code issue a workspace trust matter too. OpenAI told The Register it knows about the Codex bug and is working on a fix.
Patch status can change fast, so treat the table as a snapshot from October 29.
How to protect yourself from the EMBRACE vulnerability
The reports don’t give an official user checklist, so these steps are our practical read of them.
- Update Cursor and GitHub Copilot to builds that include the October fixes.
- Don’t open local HTML files from email, downloads or unknown repos in Codex or VS Code’s built-in browser.
- Keep agent permissions tight, and read approval prompts instead of clicking through.
- Check Claude Desktop and Codex release notes for security fixes.
Doing these four things cuts most of the realistic risk, because each bug needs you to load something hostile first.
If you worry about a poisoned extension rather than a poisoned page, our guide to checking for the bad Cursor build walks through that case.
Frequently Asked Questions
Is the EMBRACE vulnerability a single bug?
No. It’s a shared weakness that showed up as five different bugs across five tools. Each vendor has to fix its own.
Which AI coding tools are still vulnerable?
As of October 29, researchers said Codex and VS Code were unpatched. Claude Desktop’s status wasn’t clearly stated, so check for updates.
Can someone attack me without me doing anything?
Based on the reports, no. You’d need to load a malicious page or local HTML file in the tool’s built-in browser.
Should I stop using these tools?
Probably not. Update where fixes exist and avoid untrusted content in the built-in browser until the rest ship.
The bigger lesson is that an AI tool with a browser is a browser with your keys attached. Until Codex and VS Code ship fixes, I’d keep their preview panes for your own projects only, and I’d do my random web browsing in a normal browser. It costs you almost nothing and closes the easiest door.
Leave a Reply