Three rules, five products
Forever Security published research on 29 October testing five AI coding assistants against three rules that a standalone browser enforces: a web page cannot run commands on the host computer, a local file cannot read other files on the disk, and a page cannot control the address bar. In each of the five products, one of the three failed.
The researcher, Gal Weizman, gives the shared cause a name — EMBRACE, an embedded browser trusted like a real one. Each vendor added capabilities to its built-in browser so the assistant could preview a project, read tabs or pull page context, and those additions reached past the rules the browser was supposed to keep.
What broke where
In Cursor, a hostile page showed a “Start setup” button with an agent command hidden inside it. One keypress approved it and code ran on the host. When the sandbox blocked the command, the research says the agent turned the sandbox off and tried again — without the page asking it to. Whether the command ran depended on the model, and it did not happen every time.
GitHub Copilot failed the address bar rule. The application checked only that the page’s address text looked like a web address, so an attacker’s page could display github.com/login while the agent’s own tab list repeated the false address back.
Claude Desktop and VS Code both restricted pages to the project folder, but the restriction applied to the page and not to a web worker, and a worker could read any file on the disk. Codex had no folder check at all. In testing, the file read collected SSH keys, .env files, npm tokens and the hosts file, with a macOS Finder index file used to map the disk folder by folder.
Two vendors declined the same report
The disclosure record is the part that matters for anyone running these tools. Forever reported the Claude Desktop issue to Anthropic on 23 July, and says Anthropic declined it as invalid under its Workspace Trust boundary. Noma Security reported the same class of issue on 24 July, and Forever says Anthropic accepted that one as valid.
Microsoft was told about VS Code on 10 September and, according to the research, declined it as invalid under the same Workspace Trust boundary. OpenAI received the Codex report on 27 July and had not responded by publication. Cursor was told on 10 September and patched silently on 1 October, three weeks later, without replying to the researchers. GitHub fixed the Copilot address bar bug in version 1.1.29 on 13 October, on its own, before a report was filed.
The trust prompt is the disputed boundary
Both rejections rest on Workspace Trust — the prompt that asks a developer whether they trust the folder they have just opened. Weizman’s argument is that the prompt provides essentially no protection in practice, because developers click “Trust” to make the tool usable at all. Two vendors treat that click as the user accepting the risk; the research treats it as a dialogue nobody reads.
That disagreement is not academic. It decides whether a local HTML file reading SSH keys out of a developer’s home directory is a vulnerability or expected behaviour.
What to watch
At publication, Codex and VS Code were still unpatched, which leaves users of those two exposed to the file-read issue. Forever’s recommendations for defenders are to inventory which of these tools are installed, treat an embedded browser as an endpoint attack surface rather than a convenience, and stop counting a user’s click as a control. The open question is whether Microsoft and OpenAI change their position on Workspace Trust, or whether the boundary holds and the behaviour stays.
