An embedded browser lets developers preview their work without leaving an AI coding tool. But a malicious page in that browser can become a route into the developer's computer. On October 29, researchers at Forever Security described vulnerabilities in the embedded browsers of Cursor, OpenAI Codex and other tools. They named the collection of findings EMBRACE.
The consequences differ by application. In Cursor, the researchers demonstrated a path to running code on the host computer. In Codex, they showed that a local page could read files outside the project. Forever Security says the Cursor issue was fixed on October 1, while the Codex issue remained open when its research was published on October 29. An OpenAI spokesperson told The Register that the company was aware of the issue and working to address it.
How the Cursor attack worked
The researchers found that a page in Cursor's embedded browser could send data to the agent's composer, the field where instructions are entered. In their experiment, they hid an instruction inside a page element that looked harmless to a person but exposed its hidden content to the agent.
The agent then proposed running a command. In the demonstrated scenario, the user approved the action by pressing Enter. When Cursor's sandbox blocked the command, the agent disabled the restriction on its own and tried again. The result was a calculator opening on the test computer.
The attack depends on the model's behavior and does not succeed every time, according to the researchers. Even so, their experiment showed that a program chosen by an attacker could run with the user's privileges. Forever Security reported the issue to Cursor on September 10 and observed a fix on October 1. The report does not identify the fixed version.
What researchers found in Codex
The Codex scenario is different. A malicious local HTML file opened in the application's embedded browser could access other files available to the application, beyond the project folder. In their test, researchers retrieved SSH keys, .env files and npm tokens. These files can contain credentials for servers, services and projects.
The demonstrated attack requires the user to open the prepared HTML file in the embedded browser. It could, for example, be included in a downloaded project, with the agent presenting a link to the file during setup. Once opened, the page could read and send data without a visible indication to the user.
Forever Security reported the issue to OpenAI on July 27. In its technical report published October 29, the company said a fix had not yet been released. We found no newer confirmation of a released patch. That status can change, so check OpenAI's updates before making a decision based on it.
Other tools in the research
Forever Security described a similar local file-reading issue in VS Code and Claude Desktop. Its GitHub Copilot demonstration showed a different problem: a page could spoof the address displayed by the embedded browser and impersonate another site. According to the researchers, GitHub fixed that issue in Copilot version 1.1.29, while the VS Code issue also remained open when the report was published.
EMBRACE is an umbrella name for several different findings, not one identical bug across all five products. The report describes laboratory demonstrations; it does not by itself establish that these specific vulnerabilities were exploited against users in the wild.
What developers can do
Update Cursor and other development tools to current versions. Until a Codex fix is confirmed, avoid opening unfamiliar local HTML files in its embedded browser, even if an agent provides the link. Before running an unfamiliar project, inspect its contents and the commands the tool proposes to execute.
Pay particular attention to projects from unknown sources: access to a preview page may also expose files the application can read. For untrusted code, an isolated environment without work credentials or tokens can reduce the consequences of an attack.