Five AI coding tools shipped a browser you could break

Posted on Oct 30 • Originally published at voxahq.in

Security researchers published a class of flaws this week in the browsers embedded inside five AI coding tools: Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. A rigged web page or a local HTML file could run code, fake the address bar, or read files outside the project folder.

Two of the five had no fix as of 29 October. That is the part to act on.

The research, published by Forever Security and reported by Hackread and Help Net Security, names the class EMBRACE: embedded browser, trusted like a real one.

The design makes sense on paper. These tools now ship a small browser inside the editor so a model can read documentation or preview a page it just wrote. That browser was treated as trusted, which is exactly the assumption an attacker needs.

That last one is how SSH keys, cloud credentials and.env files leave a machine.

Most developers who use these tools behave the same way: clone a repository, open it, let the assistant read the folder. If the project contains a crafted HTML file, the file is inside the trusted boundary the moment the workspace opens.

The disclosure timeline makes it worse. Researchers reported the Codex issue to OpenAI on 27 July and the VS Code issue to Microsoft on 10 September. As of 29 October, both were still unfixed. Anthropic and Microsoft declined the reports and pointed at Workspace Trust, the prompt that asks you to confirm you trust a folder.

That argument is circular in practice: the trust prompt is exactly the click a malicious project needs.

Treat a cloned repository the way you treat an email attachment.

Nothing exotic is required. A maintainer of a small open source project, or anyone who can get a pull request merged, adds an HTML file. It looks like a documentation preview, a test fixture, or a demo page.

You clone the repo and open the folder. The assistant, doing its job, reads the workspace. The page loads inside the embedded browser. From there it can reach the local files the tool can reach, and the tool can reach everything your user account can.

The last step is the quiet one: nothing crashes, nothing obvious appears, and the file is exfiltrated in a normal-looking request. Credentials leave, the project looks fine, and you find out weeks later when a bill or a build pipeline behaves strangely.

Anthropic and Microsoft both declined the reports, citing Workspace Trust. The researchers disagree with that reasoning, because the trust prompt is user-controlled and a project can be crafted to make trusting it look reasonable.

OpenAI and Microsoft were given the Codex and VS Code reports in July and September respectively. The gap between disclosure and fix is the number that matters for anyone running those tools today.

If you cannot answer the first two from memory, that is the finding.

This is the third month in a row where the interesting AI security story is not about a model being clever. It is about the plumbing around the model being trusted by default.

Agents and coding assistants are being given more access, not less: to files, to terminals, to browsers. Each new surface is another place where "trusted because it is local" turns out to be a guess. The teams that come out of this fine are the ones that treat every new integration as untrusted until it proves otherwise.

Full note with sources: voxahq.in. No affiliate links, no sponsored rankings.