Researchers find sandbox-escape flaws in embedded browsers of major AI coding tools

Security researchers have found that the browsers built into several popular AI coding tools can be escaped to run commands or read files on a developer's machine, Help Net Security reports. The research, from the firm Forever Security and written up by Gal Weizman, affects Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic Claude Desktop. Forever calls the pattern EMBRACE, short for "an embedded browser trusted like a real one."

What happened

According to Help Net Security, each tool embeds a browser to render content, and Weizman's team found that in each product one of three core browser security rules failed: web pages being able to run commands on the computer, local files being able to read other files, or pages being able to change the address bar. Forever's disclosures to the vendors ran from July 23 to September 10, 2026, and Help Net Security published its report on October 29.

Technical details

Help Net Security describes the impact per product. In Cursor, a web page combined with a single Enter press let an attacker run commands with the developer's full privileges, and a demo opened the Calculator app to prove code execution. In GitHub Copilot, a page could display a fake address, such as github.com/login, over a fake sign-in form, enabling convincing phishing. In Codex, VS Code and Claude Desktop, a single local file could read the rest of the disk; in a demonstration this exposed SSH keys, .env files, npm tokens and the hosts file, and the outlet says opening a rigged project and clicking one link was enough to trigger it. Help Net Security does not list CVE identifiers.

Who is affected

The affected tools are used by large numbers of developers, which broadens the potential exposure. Help Net Security reports a mixed patch picture: Cursor fixed the issue on October 1, three weeks after Forever's September 10 disclosure, and GitHub fixed Copilot in version 1.1.29 on October 13. As of October 29, Codex and VS Code had no fix; Microsoft declined Forever's VS Code report, citing its Workspace Trust feature. For Claude Desktop, the outlet says Anthropic declined Forever's July 23 report, though it accepted a similar report from Noma Security, and does not state whether Claude Desktop is fixed.

What to do

Developers should update the tools that have shipped fixes, including GitHub Copilot to version 1.1.29 or later and Cursor to its patched release. Because the attacks rely on opening untrusted content, users of tools without fixes should be cautious about opening unfamiliar projects or clicking links inside these applications, and should avoid working with untrusted repositories in environments where sensitive files such as SSH keys and .env files are present. Organizations should watch for vendor advisories and apply updates to Codex and VS Code when they become available.