EMBRACE Attacks: AI Coding Tools' Embedded Browsers Open a Backdoor to Your Dev Machine
These vulnerabilities turn AI-assisted editors into a semi-open service that can read tabs, local files, and receive page messages, so one malicious webpage can compromise a developer's machine and steal production credentials. Two of the affected tools went unpatched for months, making active exploitation a realistic risk.
EMBRACE attacks work because five AI coding tools—Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code, and Anthropic's Claude Desktop—embed a webview that grants pages capabilities a normal browser would never allow. A malicious page can send messages into Cursor's agent, which reassembles a command split across attributes and executes it, bypassing the model's defenses. In Codex, VS Code, and Claude Desktop, file pages can read any local file by putting the read in a Web Worker, which bypasses the project fence that only checks the top-level document; Codex doesn't even need a worker, as its top-level page can fetch directly. GitHub Copilot lets pages report their own address, so a fake github.com/login page can phish a user while the agent believes it's on the real site.
The report, published October 29, lists dates: Codex's issue was reported to OpenAI on July 27, VS Code's on September 10, and neither was patched by public disclosure. Cursor silently fixed its issue on October 1; Copilot was fixed in version 1.1.29 on October 13. The research shows that .DS_Store files on macOS can turn directory listings into full filesystem traversal, exposing SSH keys, .env files, and npm tokens. Four mitigations follow: update all five tools, treat any file page in an AI assistant as malicious, revoke default trust for credentials, and disable auto-run with an empty allowlist.
AI agents' input channels become a new trust boundary: relaxing one browser rule per product seems reasonable individually, but together they give pages capabilities that browsers spent decades denying.
The long unpatched windows for Codex and VS Code suggest vendors treat risks that only trigger on user action as low priority, despite the potential for credential theft.
When an agent itself disabled the sandbox to run a payload, it showed that model-driven autonomy can amplify an injection into a more severe compromise than the payload alone would cause.