Summary
- Research examined embedded browser components across five AI development tools.
- Demonstrated impacts vary by product and are not one shared vulnerability.
- Several fixes were released, but some issues remained unresolved at disclosure.
Researchers at Forever Security have disclosed separate security weaknesses in the browser components embedded in five desktop AI assistants and development tools. Their testing covered Cursor, GitHub Copilot, Codex, Visual Studio Code and Claude Desktop, demonstrating outcomes ranging from false browser-address information to local file disclosure and code execution on the host machine.
The research calls the class EMBRACE, but the five products do not share a single software defect. Instead, their embedded browsers extend ordinary web browsing in ways intended to support an AI agent: pages may pass information to the assistant, report location and state, or interact with local files. Those additions can cross boundaries that a conventional web browser is designed to maintain between untrusted content and the operating system.
In Cursor, researchers found a path for a malicious page to supply data that the assistant treated as instructions. Their demonstration progressed from page-controlled content to a software-installation action and host execution. The researchers say success depended partly on model behaviour, and the issue was patched on 1 October following disclosure in September. This is a demonstration of a trust-boundary weakness, not evidence that ordinary Cursor users have been compromised through this route.
In GitHub Copilot, the demonstrated flaw allowed a page to misrepresent its location to the embedded preview and to the agent. The address appeared to be a trusted sign-in page even though the content remained on an attacker-controlled site; GitHub corrected that behaviour before publication. The Claude Desktop, Codex and VS Code demonstrations instead depended on local file previews escaping intended file-access boundaries, with a user action needed to open the prepared content.
The integration failures arise when an embedded application accepts a webpage’s own claims about its identity or instructions as authoritative. A webpage should not be able to determine its own trusted location inside the browser’s security model, and remote content should not gain access to arbitrary local files simply because an assistant wants to summarise a page. When those claims originate in lower-trust content, passing them into a privileged agent can convert information retrieval into an action with operating-system consequences.
Development environments frequently hold source code, configuration files, API credentials and access tokens alongside the assistants that browse external content. An assistant running beside those assets may be granted far more permission than the website or document that it has been asked to inspect. The precise harm depends on each product’s access controls and whether a vulnerable feature is enabled, but these differences do not remove the underlying requirement to distinguish page content from instructions.
The disclosure records fixes for Cursor and GitHub Copilot before publication. The researchers say the Codex and VS Code file-access issues remained unpatched on 29 October; Anthropic accepted a related Claude Desktop report after an initial disagreement about workspace trust. These product-specific states should not be collapsed into a claim that all five implementations remained exposed in the same way.
An agent may read a webpage as information while its surrounding desktop application also grants the agent permission to act on files and tools. In an agent environment, an embedded page can be both an information source and an input to a tool-using model. If the application takes a page-supplied value as authoritative, the user may have little indication that the subsequent action was influenced by untrusted material. Forever Security’s tests used those specific integration behaviours rather than a universal weakness in Chromium or a general flaw in every language model. This narrows the affected surface to particular desktop implementations and versions.
Unlike a generic prompt-injection scenario, the demonstrations involve identifiable integration points where untrusted browser content acquired authority over an assistant’s environment. The researchers demonstrated host execution in Cursor, misleading address information in Copilot, and local-file exposure in other products. Future vendor fixes may change the affected versions, but the documented failures occurred at the boundary between webpage or project content and the surrounding desktop application.
