AI coding tools ship with built-in browsers, and those browsers were given powers normal browsers don’t have. Security startup Forever Security found that’s a problem.
What they found
Forever calls the bug class “Embrace” (EMbedded BRowser). According to The Register:
- Cursor: a web page in the built-in browser could feed hidden instructions to the agent’s composer, opening the door to prompt injection and code execution. Disclosed Sept 10, quietly patched Oct 1.
- GitHub Copilot: a page could tell the app its own address, so a phishing page could show a fake URL like github.com/login. Fixed in 1.1.29 on Oct 13.
- Claude Desktop, VS Code and Codex: a local HTML file opened in the built-in browser could read other files on the machine. In Claude Desktop and VS Code it worked through web workers. In Codex, no workaround was even needed.
OpenAI says it’s working on the Codex fix, but it’s still unpatched. Forever says Microsoft called the VS Code report invalid, and it also remains unpatched.
My take
Don’t open random local HTML files or sketchy pages inside your coding agent’s built-in browser until these are fixed. Keep the tools updated, and keep agents in folders that don’t hold anything you can’t afford to leak.
God Bless, and Needs Garlic!
