Security startup Forever Security found vulnerabilities in five AI developer tools: Cursor, GitHub Copilot, Claude Desktop, VS Code and Codex. All five share one cause. Each tool handed its embedded browser capabilities a normal browser does not have, and those capabilities break the threat model browser security rests on.
Researcher Gal Weizman calls the class “Embrace,” short for EMbedded BRowser. The consequences differ by tool: code execution in Cursor, data theft in Claude Desktop, Codex and VS Code, and address bar spoofing in GitHub Copilot.
A web worker walks past the folder boundary
Claude Desktop and VS Code let locally opened HTML files reach their respective project folders. That part is intended. The restriction does not cover web workers, though—JavaScript running in a background thread alongside the page. A local page starts a worker, and the worker reaches any file on the machine. Codex did not even need the detour: there, a local page could read any file directly.
Cursor’s problem was a different one. Its integrated browser lets a page call the agent’s composer. The agent reads that as instructions and follows them, invisibly to the human in the chair—prompt injection, ending in commands on the host. Forever disclosed it on September 10, Cursor silently patched on October 1, published no advisory and never replied to the researchers.
Copilot had a third flavour. Because some pages change their address without loading a new page, Copilot let the page report its own address, checking only whether the text looked like a URL. That is enough to display github.com/login in the address bar while a phishing page loads underneath. GitHub fixed it in build 1.1.29 without ever receiving a report from Forever.
“Workspace trust,” twice over
The part that sticks is how the reports were handled. Forever sent the Claude Desktop finding to Anthropic on July 23. Anthropic rejected it as invalid, saying the security boundary was gated by “workspace trust”—the fact that you have to trust a folder first. A day later, Weizman says, Noma Security reported the same flaw, and Anthropic accepted that report. Anthropic did not answer The Register’s questions about either one.
Microsoft gave Forever the same answer on September 10—invalid, workspace trust gated—and the researchers say the VS Code flaw is still open. OpenAI, told on July 27, never responded at all; a spokesperson later told The Register it is aware of the issue and working on it.
Trusting a folder is not trusting every file in it
Workspace trust is a sensible boundary, but it does not answer this question. Trusting a repository means letting the agent work in it. It does not mean letting an HTML file from that repository read your SSH keys through a background thread. That second step is exactly what the flaw takes, and it is the point where a folder grant turns into access to everything.
The real finding is that three vendors independently reached for the same dismissal. Embedded browsers inside agents are new, the reasoning about their boundaries is borrowed from the IDE world, and this class of bug lives in the gap between the two.