Forever Security published 'EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants' on 29 October 2026.

It says it researched the browsers embedded in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop and broke a core browser-security rule in every one, with impact ranging from running code on the host (Cursor) to reading and exfiltrating files on the disk (Codex, Claude Desktop, VS Code) to spoofing a tab's address to both the person and the agent (GitHub Copilot).

According to Forever, Cursor's integrated browser let any page send text into the agent's composer, which it used to get the agent to run an npm install; it says success is probabilistic and depends on the model, that it disclosed the issue to Cursor on 10 September and that it was silently patched on 1 October.

It says it found the address-bar spoof in GitHub Copilot 1.1.27 on 26 September and that GitHub fixed it independently in Copilot 1.1.29 on 13 October, before Forever sent a report.

For Claude Desktop and VS Code, Forever says a local file:// page could read files outside the project folder from a web worker, and that Codex applied no such restriction at all.

Its timeline says Anthropic declined its 23 July report as invalid for a 'Workspace Trust' gated security boundary and accepted the same issue from Noma Security on 24 July; that OpenAI never replied to its 27 July report; and that Microsoft declined its 10 September report on the same grounds.

Forever says that at the time of publishing the Codex and VS Code issues were still open. (source: Forever Security) The Register reported at 23:12 UTC on 29 October (7:12 am Perth time, 30 October) that an OpenAI spokesperson said OpenAI is aware of the issue and working to address it, and that Cursor, GitHub, Anthropic and Microsoft did not respond to its questions. (source: The Register)