EMBRACE researchers report browser flaws in five coding assistants
Forever Security published an analysis on 29 October 2026 of embedded-browser flaws in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. Researchers say some allow malicious pages to reach computer functions or files.
The report describes three risks: command execution through Cursor, a spoofed address display in Copilot and local-file reads through Codex, VS Code and Claude Desktop previews. These demonstrations have opening and interaction requirements; they do not establish an ongoing attack campaign.
Researchers report fixes for the relevant Cursor and Copilot issues. At publication they identify no fix for Codex or VS Code and no identifiable fixed Claude Desktop version. Those findings are dated to the report, without assuming they describe every current version.