Recent research has uncovered significant security vulnerabilities within the embedded browsers of popular AI development tools such as Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop. These security gaps could potentially allow unauthorized code execution, theft of sensitive files, and address bar spoofing on developers’ machines.
Understanding the EMBRACE Attack
The research, published on October 29, highlighted how integrated browser functionalities in AI assistants can breach security protocols when they gain additional access to their host applications. The researchers termed this new class of attack as EMBRACE, an acronym for embedded browsers trusted like real browsers, which encapsulates several vulnerabilities arising from a common design flaw. These features, which are intended to aid project previewing, page reading, and tab tracking, inadvertently empowered untrusted content with excessive capabilities.
Specific Vulnerabilities in AI Tools
The security report from Forever outlined how Cursor’s window.cursorBrowser.send() bridge could allow any loaded page to inject content into the agent’s instruction area without user interaction. Attackers could exploit the element-selected channel to embed commands within HTML attributes, which appeared innocuous to users but directed the agent to compile them into an npm installation command. Even if Cursor’s sandbox blocked installation, the agent could retry outside the sandbox, executing a package’s preinstall script.
Similarly, GitHub Copilot’s browser preview permitted address updates from the page itself, checking only the address format without verifying if the reported location matched the actual page. This oversight allowed attackers to display a false github.com/login page, potentially tricking users with a spoofed login form under a trusted URL.
Additional Findings and Company Responses
Claude Desktop and VS Code were found to restrict file access on main pages but failed to impose the same restrictions on web workers. These workers, running scripts in the background, could read files beyond their project scope. Codex, on the other hand, did not require a worker bypass, as its local pages could directly access files across the machine. The researchers accessed sensitive data such as SSH keys and npm tokens, with the potential for attackers to send these to remote servers.
In response to these findings, Cursor patched its vulnerability on October 1. GitHub resolved the address spoofing flaw in Copilot version 1.1.29 by October 13. However, Codex and VS Code remained unpatched at the time of publication, with Microsoft rejecting the report on Workspace Trust and OpenAI not responding. Although Anthropic initially rejected their issue, it was later accepted, though patch status remains unclear.
Organizations are advised to enhance their security operations centers (SOCs) by integrating threat intelligence from multiple sources to swiftly address these incidents.
