EMBRACE: How We Hacked the Browsers Embedded in Top Five Desktop AI Assistants · Forever Security

Researchers discovered severe security vulnerabilities across five prominent desktop AI coding assistants—Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop—stemming from a shared architectural flaw they call EMBRACE. By fusing traditional web browsers into agentic software and treating them with excessive trust, these tools allow malicious web pages or local files to execute arbitrary code, exfiltrate data from the entire hard drive, or spoof address bars. While GitHub Copilot and Cursor have addressed their respective issues, vulnerabilities in Codex and VS Code remained unpatched at the time of publication. Open article →