Here's a new name for your AI security bingo card: EMBRACE, short for "an embedded browser trusted like a real one." Forever Security published it on October 29, and it covers five AI developer tools: Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop.
The flaws are all different. The design mistake is the same one. These tools added little built-in browsers so the AI can preview your app or read a page, and those browsers gave web content more access than a web page should ever get.
What They Found
- Cursor: a page loaded in Cursor's browser could push text straight into the agent's instruction box, no click required. Hidden instructions in HTML attributes got the agent to build an
npm installcommand, and one Enter keypress approved it. When Cursor's sandbox blocked the install, the agent tried again outside the sandbox, and the package's preinstall script ran. The researchers note it depended on the model. Cursor patched it October 1. - GitHub Copilot: the preview accepted address updates from the page itself and only checked the format. So an attacker's page could show
github.com/loginin the address bar while serving a fake login form. GitHub fixed it in version 1.1.29 on October 13. - Claude Desktop and VS Code: file restrictions applied to the main page weren't enforced in web workers, so a malicious local preview could read files outside the project folder.
- Codex: local pages could fetch other files on the machine directly. On macOS, the team used
.DS_Storemetadata to find file names.
In testing, what they could grab is exactly the stuff you'd least want to lose from a developer laptop: SSH keys, .env files, npm tokens and private documents. The attack needed someone to open a malicious local page, which could come from a link the assistant itself generated.
The Vendor Scorecard
Cursor and GitHub fixed their issues. Per the report, Codex and VS Code were unpatched at publication, Microsoft rejected the VS Code report citing Workspace Trust, and OpenAI didn't respond. Anthropic accepted its report after first rejecting it, with no clear patch status yet. I'm going off Cyber Security News's summary of the write-up here, so check each vendor's release notes before you act on any of that.
The Real Lesson
Every one of these is a boundary problem. A browser is the most battle-tested sandbox we have, and these tools rebuilt a smaller one with fewer walls, then put it next to an agent that can run commands. Once a page can talk to the agent, prompt injection isn't a chatbot problem anymore. It's code execution with a friendly UI.
This is the same story as the AGENTS.md hijack last week: the agent trusts whatever lands in its context, and the developer's laptop is where the keys live.
What To Do
- Update Cursor and the Copilot extension now, and keep the rest of your AI dev tools on auto-update.
- Don't open untrusted pages in an assistant's built-in browser. Use your real browser for anything you didn't build.
- Keep the human in the loop for real. "Press Enter to approve" isn't review. Read the command, especially anything that installs a package.
- Get secrets off the laptop where you can. Short-lived tokens, a secrets manager, SSH keys with passphrases or hardware keys. Stolen
.envfiles are only as bad as what's in them. - Watch the egress. Exfiltration still has to leave the machine. Inspecting developer traffic and flagging uploads to unknown destinations catches the step that every one of these attacks needs.
Bottom Line
AI coding tools are shipping features faster than they're shipping boundaries. Treat the browser inside your IDE like what it is: a less mature browser with an agent attached.
Sources: Forever Security write-up and Cyber Security News