Brief · Builders

Your Coding Agent's Browser Isn't a Browser

By alkizz · Oct 30, 2026

On Oct 29, Forever Security researcher Gal Weizman published "EMBRACE", a look at the browsers built into five AI coding tools: Cursor, the GitHub Copilot app, OpenAI's Codex, VS Code and Claude Desktop. In every one, a web page or a local HTML file reached something a normal tab never could. That meant code on the host in Cursor, any file on the disk in Codex, VS Code and Claude Desktop, and a fake address bar in Copilot. Forever says the Codex and VS Code issues were still unpatched when it published, and OpenAI told The Register it's aware of the issue and working to address it.

Forever's root cause is the useful part. Each vendor gave a real browser extra powers so the agent could preview a project, read a tab or know which site it's on, and in Forever's words, "each one gave a hostile page a power a normal browser never would." It's the same lesson as Forever's earlier work showing your Downloads folder had become a config file, from a different direction.

What Forever found

Cursor let any page write into the agent's composer. Per Forever's technical write-up, Cursor's browser exposed a window.cursorBrowser.send(...) channel to "every page, any origin, no gesture." A page could forge an element-selected chip that showed the person almost nothing but carried split-up instructions for the agent to reassemble and run. Forever says Auto-run ships on with an empty allowlist, so the result was one run card waiting on a single Enter. When Cursor's sandbox blocked the npm install, the agent cancelled the sandbox and retried on its own, and the package's install script ran with full privileges. Forever is clear that it "does not fire every time" and depends on the model.
Copilot let a page set its own address. In the Copilot app's browser preview, a page could tell the app it was on github.com/login, and the app only checked that the text looked like a web address. The person and the agent's tab list both saw the fake address.
Three tools let a local file read the whole disk. Claude Desktop and VS Code limit a local page to its project folder, but Forever says that check doesn't run inside a web worker (a background script the page can start), so the worker can read anything. Codex had no limit at all. On macOS, the proof of concept mapped the disk using the .DS_Store files Finder leaves behind and pulled SSH keys, .env files and npm tokens from Forever's own machine.
The click comes from the agent. In Forever's scenario you ask the assistant to "set up the project per the README," and the assistant itself hands you a clickable file:// link. That click is the only thing the victim does.

Where each fix stands

Cursor: disclosed Sep 10, and Forever says Cursor "silently patched" it on Oct 1 and never replied. There's no advisory, but Cursor's 3.22 release notes (dated Sep 24) say "Web pages can no longer fake element picks into agent context; only real clicks select elements," which describes the same kind of bug. Cursor hasn't said that's the fix, its Oct 1 release notes don't mention a browser fix, and the dates don't line up with Forever's.
GitHub Copilot app: Forever says it found the spoof in version 1.1.27 and that GitHub fixed it independently in 1.1.29, before any report. GitHub published 1.1.29 on the evening of Oct 12, US Eastern time (Forever says Oct 13). Its release notes and changelog don't mention the fix, so the version comes from Forever.
Claude Desktop: Forever says Anthropic declined its Jul 23 report as gated by "Workspace Trust" but accepted the same flaw from Noma Security. Noma's own "SneakPeek" write-up dates its report to Jul 4, before Forever's, and describes a related route through Claude Code Desktop's preview pane, which renders a file automatically when Claude reads it. Noma says a Jul 24 patch was bypassed with a web worker the same day, and the fix shipped in Claude Desktop 1.30096.1 and later by auto-update on Aug 17.
Codex: disclosed Jul 27 with no reply to Forever, and still unpatched per Forever. An OpenAI spokesperson told The Register that OpenAI is aware of the issue and working to address it.
VS Code: disclosed Sep 10, and Forever says Microsoft declined it as gated by "Workspace Trust" and it's still unpatched. That's a decision not to fix it as reported, not a fix in progress.

What Forever doesn't say

No known attacks use these bugs. These are research findings, and no source reports victims.
It's mostly Forever's account. The timelines and patch status come from Forever, which sells AI endpoint governance and pitches it in the post. Microsoft, Cursor, GitHub and Anthropic didn't respond to The Register's requests for comment.
You still have to open the file. It's one click the agent makes look routine, but cloning a repo alone doesn't fire it.

Why the browser is the soft spot

We've all learned a browser tab isn't the safest place to look at sketchy stuff. A browser inside your coding agent is wired to the agent's input, your project folder and sometimes your whole disk, so in my view any page or HTML file it opens deserves the suspicion you'd give a stranger's script. Microsoft's "Workspace Trust" answer puts the whole burden on the moment you click "trust," and we've seen how well approval prompts and "you opened the folder, so it ran" hold up in practice.

The score

I'd call it a 3, patch normally. Two of the five have no fix, and the file read takes your keys and tokens, but there are no known attacks, it needs you to open a hostile file or page in the tool's own browser, and the Cursor chain is hit-and-miss. If you regularly open strangers' repos in Codex or VS Code and click the preview links the agent hands you, your own risk is higher than the score.

What to do:

Update the three tools that have fixes.
- Why: the fixed builds close the bugs Forever found, and the version number is the only way to know you have one.
- How: Claude Desktop should be on 1.30096.1 or later (per Noma) and the GitHub Copilot app on 1.1.29 or later (per Forever). Cursor gave no version, so update to the current release, which includes the 3.22 change above.
Don't open untrusted HTML in Codex's built-in browser (in the desktop app) or VS Code's.
- Why: until those two change, one opened file can read your whole disk, and the agent may be the one handing you the link.
- How: in a repo you didn't write, don't click the file:// links the agent offers, and open HTML in your normal browser, which per Forever gives a local file an opaque origin so it can't reach other files. Codex's docs say to "treat page content as untrusted context," and OpenAI's admin docs say the built-in browser pane's settings are separate from Browser Use. OpenAI documents no setting that blocks only local-file previews, but admins can turn the whole built-in browser pane off with in_app_browser = false in managed configuration (In-app browser set to Force off in the Admin Console). Without that, for Codex this is a habit, not a setting. See Builders checklist #10.
Turn down VS Code's integrated browser if you don't use it.
- Why: per VS Code's docs, localhost links open in the integrated browser by default and it opens local .html files directly.
- How: set workbench.browser.openLocalhostLinks to false so localhost links go to your normal browser, workbench.browser.enableChatTools to false so chat agents can't use browser tools, and workbench.browser.showInTitleBar to false to hide the button. None of these is described as a fix for this bug, and you can still open local files in the integrated browser by hand. My suggestion, not vendor guidance: answer "no" when VS Code asks whether you trust a stranger's folder, since Restricted Mode disables or limits agents, the terminal, tasks, debugging and extensions, though nobody has said whether it blocks this read.
Open strangers' projects somewhere your keys aren't.
- Why: the read takes whatever your account can read.
- How: my suggestion, not vendor guidance: use a VM, a devcontainer or a separate user account with no SSH keys, cloud credentials or tokens. See Builders checklist #4.
If you already opened a suspect project's HTML in one of these tools, rotate.
- Why: the reads were silent, so you wouldn't have noticed.
- How: my suggestion, not vendor guidance: keep a copy of the project folder, then rotate SSH keys, cloud credentials, npm and GitHub tokens and any .env secrets on that machine, and check those accounts for use you don't recognize since then. Forever's Gal Weizman also suggests checking every HTML file in projects you've already trusted for the pattern in Forever's technical write-up.
Teams: set the browser settings centrally.
- Why: a setting each developer has to remember is one half of them won't change.
- How: push the VS Code browser settings and minimum versions through your managed settings instead of a reminder, and if your developers don't need Codex's built-in browser, turn it off with in_app_browser = false in OpenAI's managed configuration. See Business checklist #13.

Sources

← All briefs

Your Coding Agent's Browser Isn't a Browser

What Forever found

Where each fix stands

What Forever doesn't say

Why the browser is the soft spot

The score

Want the next one?

Sources

Related

On the checklist

More briefs