EMBRACE Flaws Turn AI Coding Tool Browsers Into Attack Paths
Key Takeaways
- Forever Security published EMBRACE on October 29, 2026, covering the built-in browsers of five AI coding tools.
- In Cursor, a web page could feed hidden instructions to the agent and run a command.
- In Codex, VS Code, and Claude Desktop, a local HTML file could read SSH keys, .env files, and tokens.
- Codex and VS Code were unpatched at disclosure; no exploitation has been reported.
Built-In Browsers Trusted Like Real Ones, Without the Rules
The browsers built into five popular AI coding tools gave web content powers a normal browser never would. The Register reported code execution in Cursor, data theft in three tools, and address bar spoofing in GitHub Copilot.
What We Know
Researcher Gal Weizman published the work on October 29, 2026. Cursor fixed its issue on October 1, and GitHub fixed Copilot in build 1.1.29 on October 13.
Anthropic first declined the Claude Desktop report, then accepted the same issue from another researcher. Forever says Claude Desktop is no longer exploitable, though no fixed version was published.
OpenAI says it is working on a Codex fix. According to Let's Data Science, Microsoft declined the VS Code report, citing Workspace Trust. No exploitation has been reported.
What Could Happen
A normal browser treats every page as hostile. Each of these tools relaxed at least one of those rules for convenience.
In Cursor, a page could reach the agent's command box. It showed a harmless setup button while feeding the agent hidden instructions, and when the sandbox blocked the command, the agent turned the sandbox off and retried.
In the other three tools, background scripts in a local HTML file escaped folder limits. As DevOps.com reported, one file swept up SSH keys, .env files, and npm tokens.
Why It Matters
The files at risk are exactly what attackers need to move from a laptop into source control, pipelines, and production.
The trigger can be a file in a cloned repository, which fits easily into supply chain campaigns.
Vendors leaning on trust prompts, silent patches, and fixes without version numbers left teams unable to verify exposure. The NIST AI RMF expects organizations to understand the components their AI tools depend on.
PointGuard AI Perspective
EMBRACE shows how much hidden capability sits inside AI developer tools. PointGuard AI starts with visibility.
AI discovery inventories AI tools, agents, and MCP servers across repositories, IDEs, and runtime telemetry, so teams can find unpatched installs quickly. Agentic endpoint security extends that view to developer workstations.
PointGuard AI guardrails scan files and tool outputs for injection patterns before they reach the model. Pre-execution validation checks agent actions against policy, so an agent cannot quietly switch off its own sandbox.
Brokering secrets through HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault reduces the static keys a file read flaw can steal. Continuous AI security testing probes AI systems for new weaknesses as tools change.
AI coding assistants should be held to the same security boundaries as any browser or endpoint.
Incident Scorecard Details
Total AISSI Score: 5.85/10
Criticality: 7, Developer machines hold SSH keys, secrets, and registry tokens. AISSI weighting: 25%
Propagation: 6, One flaw class spanned five tools and can ride in a cloned repository. AISSI weighting: 20%
Exploitability: 4, Working proofs of concept, no observed exploitation. AISSI weighting: 15%
Supply Chain: 7, Risk sits in vendors' embedded browsers, with silent or disputed fixes. AISSI weighting: 15%
Business Impact: 5, No confirmed harm, but two major tools were unpatched at disclosure. AISSI weighting: 25%
Sources
Third-Party Sources
- The Register: Researchers find bugs in 5 AI developer tools
- Let's Data Science: Forever Security finds EMBRACE flaws in five AI coding tools
- DevOps.com: AI Coding Assistants' Built-In Browsers Open a Path to Developer Secrets
PointGuard AI Sources
AI Security Severity Index (AISSI)
0/10
Threat Level
Criticality
7
Propagation
6
Exploitability
4
Supply Chain
7
Business Impact
5
Scoring Methodology
Category
Description
weight
Criticality
Importance and sensitivity of theaffected assets and data.
25%
PROPAGATION
How easily can the issue escalate or spread to other resources.
20%
EXPLOITABILITY
Is the threat actively being exploited or just lab demonstrated.
15%
SUPPLY CHAIN
Did the threat originate with orwas amplified by third-partyvendors.
15%
BUSINESS IMPACT
Operational, financial, andreputational consequences.
25%
Watch Incident Video
Learn More