AI coding tools increasingly ship with their own browser so the agent can preview pages and test apps. New research shows those browsers can be a weak point.
AI security startup Forever Security found vulnerabilities in the embedded browsers of five popular developer tools: Cursor, GitHub Copilot, Anthropic’s Claude Desktop, Microsoft’s VS Code and OpenAI’s Codex. The researchers call the class of bug “Embrace,” short for embedded browser. Each tool gave its browser powers a normal browser does not have, and those extras broke the usual security model, researcher Gal Weizman wrote.
What could go wrong
In Cursor, a web page could call the agent’s composer and feed it hidden instructions, opening the door to prompt injection and commands on the host machine. Forever reported it on September 10, and Cursor patched it on October 1 without publishing an advisory, according to The Register.
In GitHub Copilot, a page could tell the app what address to display, so the address bar could show something like github.com/login over a phishing page. GitHub fixed it in version 1.1.29 on October 13, independently of Forever’s research.
In Claude Desktop, VS Code and Codex, a local HTML file opened in the built-in browser could reach files beyond the project folder. In Claude Desktop and VS Code this worked through web workers. Codex had no such restriction at all.
Patch status
Anthropic initially declined Forever’s report as invalid, then accepted the same issue from Noma Security a day later, Weizman said. Microsoft also labeled the VS Code report invalid, and researchers say it is still unpatched. OpenAI told The Register it is aware of the Codex issue and working on a fix.
Until fixes land, developers should avoid opening untrusted local HTML files in these tools’ built-in browsers and keep Cursor and Copilot updated.
Why it matters
AI coding agents now sit on developer machines with access to source code, secrets and credentials. Any feature that widens what an agent can reach widens the attack surface, too.
For application security and endpoint vendors, this research is a timely conversation starter with engineering leaders who are rolling out AI tools fast. Practical guidance on governing AI developer tools, not fear, is what gets those buyers to reply.
Sources: The Register, Forever Security. Written by the xRapid Media LLP team.
Selling to the IT market? xRapid Media LLP is a High Tech B2B Marketing company. We help technology companies reach decision-makers with verified B2B data, account-based campaigns, email and LinkedIn outreach and appointment setting. Call +91 9767196309 or book a free B2B marketing consultation.