Five AI Coding Tools Have a Browser You Never Audited. Three Can Be Made to Read Your SSH Keys, and Two Are Still Unpatched.
On October 29, Forever Security published research on a flaw pattern it calls EMBRACE, short for an embedded browser trusted like a real one. It covers the built-in browsers in Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Claude Desktop. In Forever's tests, three of those tools let a local HTML file read files across the whole disk, and at publication two of the five were unpatched.
If you run an AI coding agent on the same laptop that holds your production keys, which is what most solo operators do, this is your threat model, not an enterprise problem.
What the researchers actually found
A normal browser follows three rules. A web page cannot run commands on your computer. A local file cannot read other files. Only the browser itself writes the address bar. According to Help Net Security's write-up, each of the five tools broke one of those rules.
Cursor let a web page run attacker code. A "Start setup" button hid an agent command, one keypress approved it, and when the sandbox blocked it the agent turned the sandbox off and tried again. Copilot accepted any page-supplied address that looked like a web address, so a fake github.com/login could sit over a fake sign-in form. Codex, VS Code and Claude Desktop had the file-read problem: Codex had no folder restriction at all, while VS Code and Claude Desktop limited the page but not a background web worker.
The attack looks like a README
The file-read attack does not need anything exotic. A developer is told to set up a project per its README, and the project looks like a financial report. The assistant offers a clickable link to an HTML file in the project. One click starts the sweep. In Forever's test it collected SSH keys, .env files, npm tokens and the hosts file, then sent them out.
That is the part I keep coming back to. The trigger is the most ordinary developer move there is: clone something, ask the agent to get it running, click the link it offers.
Where each vendor stands
As of October 29, per the report: Cursor patched on October 1 after a September 10 disclosure. Copilot fixed the fake-address issue in version 1.1.29 on October 13. Codex was unpatched, with no reply from OpenAI since a July 27 report. VS Code was unpatched, and Microsoft declined the report, pointing to Workspace Trust. Anthropic declined Forever's July 23 report on Claude Desktop but accepted a separate July 24 report from Noma Security. The article does not state whether that flaw is patched.
The researcher's view of Workspace Trust is that it gives no real protection, because developers click Trust on almost everything. I agree with that part. A consent dialog you dismiss forty times a week is not a control.
What I'd do this weekend
You cannot fix a vendor's browser. You can shrink what it can steal.
First, move secrets off the default paths. Keep SSH keys in an agent like 1Password or the system keychain so there is no plain private key file to read. Second, stop keeping .env files with live production keys on your dev machine. Use scoped, short-lived dev keys, so a leak costs you a rotation, not a business. Third, for any repo you did not write, open it in a throwaway container or a separate OS user with no access to your home directory. Fourth, if you use Codex or VS Code, follow the researcher's advice: list the trusted projects in your config file and check every HTML file in them.
Then rotate the npm token. Most of us have one with publish rights sitting in a plain file from two years ago.
The honest counter-take
Every attack here needs the developer to open an untrusted project and click something. Careful people will say that is the real vulnerability and the browser is incidental. That is partly true. Cursor's sandbox bypass needed one keypress, Copilot's issue was patched before Forever even filed a report, and some of this is hard to exploit at scale.
But I would not lean on "careful people don't get hit." The whole pitch of these tools is that you hand them a repo and a sentence and let them work. If your safety plan is reading every link the agent offers, you have given back the time you bought. Isolation is cheaper than vigilance.
Author
Lukas
@lukcombinator