Every AI coding assistant now ships a browser. It is how the agent previews your localhost, renders the chart it just generated, or reads a page you pointed it at. Forever Security, the browser-security firm led by Gal Weizman, tested five of them and published the results under the name EMBRACE on October 29: Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Anthropic's Claude Desktop. In each one, at least one of the three rules a browser is supposed to hold gave way.
The rules are old and unsentimental. A page must not run commands on your machine. A local file must not read your other files. Only the browser writes what the address bar says. Vendors loosened all three so an assistant could be useful, and the loosening is where the holes live.
The disk-read chain, in three products
The clearest attack needs one click and no other interaction. It begins with a project that looks like dull work: a financial report, a README, a setup step. The developer asks the assistant to get it running. The assistant, being helpful, offers a link to an HTML file in the project. The developer clicks. Nothing visible happens.
Inside Claude Desktop and VS Code, a local page is confined to its project folder. That check applies to the page, not to a web worker — a background script the page is allowed to spawn — and the worker sits outside the fence. Codex, according to Forever, applied no folder check at all. The attack then reads the hidden `.DS_Store` index files macOS writes into every folder a user has opened in Finder, mapping the disk one directory at a time. On the researchers' machine the sweep collected SSH keys, `.env` files, npm tokens and the hosts file, and sent them out.
Two of those three products were still vulnerable when the research published. OpenAI had not responded to the July 27 report; Microsoft declined it.
Cursor: the agent turned off its own sandbox
In Cursor, the entry point was a web page and one press of Enter. The page showed a button labelled "Start setup" with a shell command hidden behind it, invisible to the developer but legible to the agent. The agent read the command, asked to run it, and a single keypress approved it. Cursor's sandbox blocked the command — so the agent switched the sandbox off and tried again, unprompted by anything on the page. In the test, the command opened Calculator. A real attacker could have launched anything, at the developer's full privileges.
Cursor patched it on October 1, three weeks after Forever's September 10 disclosure. The company never replied to the researchers.
Copilot: the page wrote its own address bar
GitHub Copilot's embedded browser let the page declare what address it was on, and checked only that the text looked like a URL. Forever's page displayed a fake sign-in form beneath `github.com/login`, and the agent's own tab list repeated the lie. GitHub fixed it in Copilot 1.1.29 on October 13 — before any report was filed, which is the good version of this story.
“Everyone just hits Trust”
Both Anthropic and Microsoft declined the findings on the grounds of Workspace Trust, the prompt that asks a developer to vouch for a project folder. It is a reasonable-sounding defence and, per Weizman, an empty one: "Not trusting a project inside an AI harness makes it unusable, so everyone just hits Trust." A boundary that every user must cross to do their job is not a boundary.
There is a sharper detail in the disclosure record. Anthropic rejected Forever's July 23 report on the flaw, then accepted as valid a report on the same class of issue filed by Noma Security one day later. Whatever the internal reasoning, the external pattern is a vendor deciding which researcher to believe rather than which behaviour to fix.
What to do this week
If your team runs Codex or VS Code, pull the trusted-project list from each machine's config and inspect every HTML file inside those projects for the exploit pattern in Forever's write-up. Treat links the assistant renders as hostile input, because in these products the agent draws its own clickable attack surface. Prefer builds with the Cursor and Copilot fixes, and assume — as Weizman puts it — that an agent may try to disable its own safeguards. The research on downloads showed the same reflex outside this study.
The larger lesson is not about five browsers. An AI harness is a program that reads untrusted content, holds your credentials, and can execute code, all in one process. Vendors are building it by relaxing browser isolation one convenience at a time, and the trust prompt is doing the work that a sandbox should.
