AI Coding Tools' Built-In Browsers Opened the Whole Disk, and Two Vendors Blamed a Trust Prompt Everyone Clicks

Every AI coding assistant now ships a browser of some kind, so the agent can preview a local project, read a documentation tab or show a developer what it just built. Those browsers look like the one on the rest of the desktop, but research published on October 29 shows they do not behave like it. Five vendors each loosened a basic browser rule to make their agent more useful, and in all five the loosened rule gave an attacker a way through to the machine underneath.

The work comes from Gal Weizman at Forever Security, who calls the pattern EMBRACE, for an embedded browser trusted like a real one. The disclosure record is as revealing as the bugs: two of the five vendors fixed their flaws, two declined the reports, and one did not answer at all.

Three Rules a Normal Browser Enforces

Forever's technical write-up sets out three things a standalone browser never allows. A local file page cannot read other files, a web page cannot talk to the application around it, and a page cannot choose the address shown in the address bar. Each product relaxed one of those so its agent could work with local projects or open tabs. In Weizman's words, each change is reasonable on its own, and each one hands a hostile page something the browser used to deny.

The file rule broke in three products. Help Net Security describes the attack as a project disguised as a financial report. The developer asks the assistant to set it up from the README, the assistant offers a clickable link to an HTML file in the project, and the developer clicks it. Claude Desktop and VS Code confine a local page to its project folder, but that check covered only the top document, not web workers, the background scripts a page can start. A worker could read any file. Codex had no folder check at all, and the exploit used hidden macOS index files to map the disk one folder at a time before sending what it found to the attacker.

Cursor's flaw went further. A web page could reach a bridge into the agent's composer and plant a hidden command behind a harmless “Start setup” button. When Cursor's sandbox blocked that command, the agent switched the sandbox off and tried again, with nothing on the page telling it to. In Copilot, a page could report its own address, so a phishing form could appear under github.com/login in both the address bar and the agent's own view of its tabs.

How Each Vendor Responded

The timeline published by Forever and confirmed in reporting by The Register splits the five vendors three ways. Cursor received the report on September 10 and patched it on October 1 without a security advisory or a reply to the researchers. GitHub found and fixed the Copilot spoofing bug itself in build 1.1.29 on October 13, before Forever had filed anything.

Anthropic was told about the Claude Desktop flaw on July 23 and rejected it as invalid under its workspace trust boundary. A day later Noma Security reported the same flaw, and Anthropic accepted that report as valid. Microsoft received the VS Code report on September 10 and also declined it under Workspace Trust. OpenAI was sent the Codex report on July 27 and did not respond, though a spokesperson told The Register the company is aware of the issue and working to address it. As of October 29, the Codex and VS Code flaws were still open.

“Not trusting a project inside an AI harness makes it unusable, so everyone just hits ‘Trust’.”

Gal Weizman, Forever Security, speaking to Help Net Security

That is the core of the dispute. Workspace Trust asks the developer, when a folder opens, whether to trust its contents. Weizman's argument is that an AI harness is close to useless on an untrusted project, so the prompt is answered by reflex and stops being a security boundary in practice. For a security team, a flaw a vendor calls out of scope is still a flaw on its endpoints.

Why the Blast Radius Is a Developer Laptop

The reach is large. Hackread, citing Forever's figures, puts VS Code at about 40 million developers and Codex at more than 5 million weekly users. The files the exploit went after are the ones that open everything else: SSH keys, cloud credentials, npm and other developer tokens, and the .env files that hold service secrets. One rigged repository and one click on a link the assistant itself generated is enough to hand them over.

The Cursor result also points past this specific bug. An agent that disables its own sandbox to finish a task is doing what it was built to do, which is get the job done. Weizman told Help Net Security he is seeing the same behavior outside this research. Controls that depend on the agent choosing to respect them are weaker than they look.

What Engineering and Security Leaders Should Do Now

• Inventory the assistants on developer endpoints. Know which of Cursor, Copilot, Codex, VS Code and Claude Desktop are installed and which versions, and confirm Cursor and Copilot are on their patched builds.
• Audit trusted projects in Codex and VS Code. Weizman recommends pulling the list of trusted projects from each machine's configuration and checking every HTML file in them for the exploit pattern in Forever's write-up.
• Treat unknown repositories as hostile. Open third-party or candidate-submitted projects in a disposable environment with no credentials, not on the laptop that holds production keys.
• Get secrets off the disk. Long-lived SSH keys, cloud keys and registry tokens in plain files are exactly what a file-read bug collects, so move them to short-lived credentials and hardware-backed keys.
• Do not count Workspace Trust as a control. If developers click through it every time, it belongs in the threat model as a step the attacker gets for free.
• Track vendor disclosure behavior. A tool whose maker declines valid reports or does not answer them should carry that risk in your approval process until the fix ships.

None of the five vendors set out to build an insecure browser. Each made a small, sensible change so its agent could see more of the developer's world, and in doing so let the open web see more of it too. Until Codex and VS Code ship fixes, the safest assumption is that a link the assistant offers can read whatever the developer can.