Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers

Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines.

The findings published on October 29 show how browser features built into AI assistants can break security boundaries when given extra access to their host apps.

The researchers named the attack class EMBRACE, short for an embedded browser trusted like a real one. These are separate flaws sharing one design problem. Features meant to help assistants preview projects, read pages, and track tabs gave untrusted content powers it should not have.

According to Forever report, Cursor exposed a window.cursorBrowser.send() bridge that allowed any loaded page to send content into the agent’s instruction box without a user gesture.

Embedded Browser Flaws in Popular AI Coding Tools Exploited

Attackers could abuse its element-selected channel to hide instructions inside HTML attributes. The visible item looked harmless, while the agent received command fragments and instructions to join them into an npm installation command.

A single Enter keypress could approve execution. When Cursor’s sandbox blocked installation, the agent independently retried outside it, allowing the package’s preinstall script to launch Calculator.

Success depended on the model and was not guaranteed. The finding adds another browser entry point to risks covered in earlier Cursor prompt injection research.

GitHub Copilot’s browser preview accepted address updates supplied by the page itself. It checked the address format but did not confirm that the reported location matched the page actually loaded.

Researchers made an attacker-controlled page display github.com/login in the preview’s address bar. The agent also received that false location, although the page remained on the attacker’s server. A fake login form could therefore appear beneath a trusted address and mislead both the user and the assistant.

Claude Desktop and VS Code restricted file access on the main page but failed to apply the same checks inside web workers, which run scripts in the background. A malicious local preview could start a worker and read files outside its project folder.

Codex needed no worker bypass. Researchers found that its local pages could fetch files elsewhere on the machine directly. On macOS, the team usedDS_Store metadata to discover filenames and expand the search across folders.

Their test collected SSH keys, .env files, npm tokens, and private documents. The demonstration sent data to a local receiver. An attacker could instead use a remote server.

Delivery required opening a malicious local page, potentially through a link generated by the assistant itself. These findings sit alongside earlier Claude sandbox escape coverage.

Forever Security says Cursor patched its flaw on October 1. GitHub independently fixed the spoofing issue in Copilot 1.1.29 on October 13, after researchers confirmed it in version 1.1.27.

At publication, Codex and VS Code remained unpatched. Microsoft rejected the report on Workspace Trust, while OpenAI did not respond. Anthropic accepted its issue after an initial rejection, but the report gives no clear patch status.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers appeared first on Cyber Security News.