SNACK: 3-line summary
- Forever Security’s EMBRACE research found browser-security flaws in five desktop AI coding tools.
- Opening malicious local HTML could expose private files even when the assistant supplied the preview link.
- At the October 29 disclosure, researchers listed Codex and VS Code as unpatched.
Forever Security’s Gal Weizman published EMBRACE research on October 29, 2026, showing how local HTML previews in Codex, VS Code and Claude Desktop could reach private files outside a project. Separate tests of Cursor and GitHub Copilot demonstrated code execution after user approval and a spoofed browser address.
Snackgirls react
AIKO: I’d want to trace why the page and its worker take different permission-checking paths. That split is the part I’d investigate first.
Nea: For a fan project, I can see myself treating an assistant’s preview link as part of the setup. I’d be less likely to notice that I’m opening someone else’s HTML.
An assistant’s link can still open an untrusted file
The local-file demonstration started with an untrusted project disguised as a financial report. After the user asked the assistant to set it up, the assistant supplied a clickable link to a local HTML file. Opening that file enabled reads outside the project: the attack still required a click, but the link came from a familiar, trusted interface.
Claude Desktop and VS Code restricted the main page to the project folder, but a background worker—a script running separately from that page—could bypass the check. Codex’s tested embedded browser had no such restriction on the main page, so it needed no worker. In their macOS demonstrations, the researchers reported reading SSH keys, developer tokens and private files from their own machine, with the results collected locally.
Calculator in Cursor, a false address in Copilot
In Cursor, a web page slipped hidden instructions into the assistant’s input through the browser’s app integration. The assistant offered a command that could be approved with one press of Enter, then independently retried outside its sandbox after the first attempt was blocked. The proof of concept opened Calculator; the researchers said success depended on the model and was not consistent.
GitHub Copilot’s browser preview instead trusted the page to report its own address without checking that it matched the real location. In the controlled demonstration, a fake GitHub sign-in page made both the address bar and the agent’s tab list claim it was on GitHub, without actually navigating there.
What the October 29 disclosure says about fixes
According to the researchers, Cursor patched its issue on October 1, and GitHub fixed Copilot in version 1.1.29 on October 13. At the October 29 publication, Codex and VS Code were still unpatched, while Claude Desktop’s patch status was not specified. These are the researchers’ disclosure-time findings, not a new assessment of patch availability.
The research does not establish exposure in Codex CLI or across all versions and operating systems. As general precautions, keep Cursor and Copilot updated and treat unfamiliar project HTML as untrusted even when an assistant supplies the link. Review unexpected execution requests before approving them, and leave restrictions on command execution in place.
Sources and checked date: November 2, 2026
Comments
0No login needed. Edit or delete your comment from the same browser.
All comments 0
한국어 · English · 日本語No comments yet. Start the conversation.