The browsers inside Codex and VS Code can still leak your files. What EMBRACE found

What Forever found

On October 29, 2026, Forever Security, the firm behind last week’s Downloads-folder report, published research it calls EMBRACE, short for an embedded browser trusted like a real one. Its researcher Gal Weizman tested the browsers built into five AI coding apps: Cursor, the GitHub Copilot app, Codex, VS Code and Claude Desktop.

Each app’s browser is there so the agent can preview your project or read a page. To do that, Forever says, each vendor loosened a rule an ordinary browser keeps: a local file:// page can’t read other files, a page can’t talk to the app around it, and only the browser writes the address bar. In all five apps, one of those rules gave way. Its conclusion: “An embedded browser is still a browser.”

Which apps are fixed

App	What a hostile page could do	Reported	Status on October 29
Cursor	Slip a hidden command into the agent, run on one Enter	September 10	Patched October 1, no version named
GitHub Copilot app	Show a fake address, such as github.com/login, in its preview	Not reported; GitHub found it first	Fixed in 1.1.29 on October 13
Codex	Read any file on the computer from a local page	July 27	Unpatched
VS Code	Read any file through a background script (a web worker)	September 10	Unpatched; Microsoft declined the report
Claude Desktop	Read any file through a web worker	July 23	No longer listed as open; no fix version or date

The dates and statuses are Forever’s, from its technical write-up. Forever says Cursor “silently patched” its flaw and “never reached back,” and that it “never heard back” from OpenAI. Anthropic declined Forever’s July 23 report, then accepted the same flaw as valid when Noma Security reported it the next day.

How the file attack works

The attack that still works is the file read in Codex and VS Code. As Help Net Security describes Forever’s demonstration:

1. You open a project disguised as something dull, a financial report, and ask the assistant to set it up as its README says.
2. The assistant offers a clickable link to an HTML file in the project.
3. You click it, and the page opens in the app’s built-in browser as a local file.
4. In VS Code and Claude Desktop, the folder check covers only the page itself, so a web worker the page starts can read outside the project. Codex, Forever says, had no folder check at all.
5. On a Mac, the page reads the hidden .DS_Store files Finder leaves in folders to map the disk, then collects what it finds. On Forever’s machine, that was SSH keys, .env files, npm tokens and the hosts file, sent to the attacker.

Cursor’s flaw ran the other way. A web page pushed a hidden command into Cursor’s agent behind a button labeled “Start setup.” When Cursor’s sandbox blocked the install, the agent turned the sandbox off and retried without being told to, and the command ran with the developer’s privileges. Forever says that attack depends on the model and doesn’t work every time. Weizman told Help Net Security that agents getting around safeguards is behavior “we’re seeing repeating itself outside the scope of this research.”

What to do now

1. Update. Cursor has carried its fix since October 1. Make sure the GitHub Copilot app is on 1.1.29 or newer, and update Claude Desktop, though no fixed version has been named.
2. Keep project HTML out of the built-in browsers of Codex and VS Code. Don’t click a link to a local HTML file the assistant offers in a project you didn’t write. OpenAI’s own docs already warn that “Instructions on a page can be misleading or malicious.”
3. Check what you’ve trusted. The attack needs a project you’ve marked as trusted. In Codex, look in ~/.codex/config.toml for [projects."…"] entries with trust_level = "trusted", per its configuration reference. In VS Code, run Workspaces: Manage Workspace Trust from the Command Palette to see and remove trusted folders.
4. Look at the HTML files in those projects before an agent opens them, especially any a README asks you to open during setup.
5. Keep secrets out of reach. Put a passphrase on your SSH keys and keep .env files and tokens out of project folders where you can. If you think a rigged page ran, replace every key and token that computer held; our LiteLLM memo lists the agent logins to cover.

Terminal agents aren’t part of this. The research covers apps with a built-in browser, so Claude Code and the Codex CLI in a terminal weren’t tested.

Why Workspace Trust didn’t settle it

Microsoft and Anthropic declined Forever’s reports for the same reason, calling the flaw invalid for a “Workspace Trust” gated security boundary: the disk read happens only in a project you’ve told the app to trust. VS Code’s docs say Restricted Mode, its mode for untrusted folders, disables AI agents along with the terminal and tasks.

That’s Forever’s objection. “Not trusting a project inside an AI harness makes it unusable, so everyone just hits ‘Trust,’” Weizman told Help Net Security, so “that prompt provides zero protection to the user.” In practice, Workspace Trust protects you only if you refuse it for anything you haven’t read.

What hasn’t been said

• When Codex gets a fix. OpenAI’s only statement, to The Register, is that it is “aware of the issue and working to address it.”
• Anything from Microsoft, Anthropic, Cursor or GitHub. None responded to The Register.
• Which Claude Desktop and Cursor versions are fixed. Neither company has named one.
• Whether Windows and Linux are affected in the same way. Forever’s demonstrations ran on a Mac; the .DS_Store mapping is specific to macOS.
• Independent confirmation. All the findings are Forever’s, a company that sells monitoring for AI agents. None of the five flaws has a CVE, and no one else has published a reproduction.