● Cursor Disclosed 10 September, patched 1 October. Three weeks.
● GitHub Copilot Fixed independently in version 1.1.29 on 13 October, before the report arrived.
● Codex Disclosed to OpenAI on 27 July. No response. Still unpatched.
● VS Code Disclosed to Microsoft on 10 September. Declined. Still unpatched.
This is a comparison of vendor behaviour, not model quality. Forever Security found the same class of flaw in five AI coding tools and disclosed to all of them. What separates these products is not what the researchers found - it is what each company did next.
| Product | What an attacker could do | Disclosed | Status |
|---|
| Cursor | A web page gets code running on the host - the researchers launch Calculator from a cold start with one Enter | 10 Sep 2026 | Patched 1 Oct |
| GitHub Copilot | A page spoofs the address bar, showing github.com/login over a phishing page, misleading the agent as well as the user | Confirmed on v1.1.27, 26 Sep 2026 | Fixed in v1.1.29, 13 Oct |
| Claude Desktop | A local file escapes its project folder and reads across the disk, through a web worker | 23 Jul 2026 to Anthropic | Declined by Anthropic; Noma Security disclosure accepted 24 Jul |
| Codex | A local file escapes its project folder and reads across the disk, with no web worker restriction | 27 Jul 2026 to OpenAI | No response, unpatched |
| VS Code | A local file escapes its project folder and reads across the disk, through a web worker | 10 Sep 2026 to Microsoft | Declined, unpatched |
What EMBRACE actually is
Forever Security gave the name EMBRACE to a shared root cause rather than a single bug: an embedded browser trusted like a real one. The browsers built into these assistants were given capabilities a normal browser does not have, and that extra trust broke the browser security model that the rest of the web depends on.
That matters because it is not a bug any one vendor introduced through carelessness. It is a predictable consequence of giving an agent a browser and then handing that browser privileges so the agent can be useful. Every vendor shipping an agentic coding tool has made some version of this trade.
Cursor: three weeks, quietly
Cursor had the most serious finding of the five - a web page getting code execution on the host machine. The researchers demonstrate launching Calculator from a cold start with a single Enter, which is the polite way of showing arbitrary code execution.
Disclosed 10 September, patched 1 October. The researchers describe it as silently patched, meaning the fix shipped without a prominent advisory. That is worth a mild criticism on transparency and significant credit on speed: three weeks from report to fix on a remote code execution path is a good number.
GitHub Copilot: fixed before the report landed
The Copilot finding was an address-bar spoof - a page could display github.com/login while serving an attacker’s phishing page. The agent is misled alongside the user, which is what makes it more than a conventional phishing trick.
The researchers confirmed it on version 1.1.27 on 26 September. GitHub fixed it in version 1.1.29 on 13 October, independently, before the researchers sent their report. That is the best outcome in the whole study and the only case where a vendor got there first.
Codex and VS Code: still open
Both allow a local file to escape its project folder and read files across the disk, which the researchers say can then be exfiltrated. Claude Desktop and VS Code do this through a web worker; Codex has no such restriction.
The disclosure history is the uncomfortable part. Codex was reported to OpenAI on 27 July and the researchers record no response. VS Code was reported to Microsoft on 10 September and declined. Both were unpatched at publication - which for Codex is more than three months after the report.
Claude Desktop sits in between: Anthropic declined the 23 July disclosure, but a separate disclosure from Noma Security on 24 July was accepted as valid. The research does not state whether it has since been patched.
What to do today
- Cursor: confirm you are on a build from 1 October or later.
- GitHub Copilot: confirm version 1.1.29 or later.
- Codex and VS Code: no patch exists. Treat the embedded browser as untrusted - do not use it to open pages you have not vetted while a sensitive repository is open.
- Claude Desktop: patch status is not stated in the research; check Anthropic’s own release notes rather than assuming either way.
- All five: the generic mitigation is to stop treating the agent’s browser as a convenience. If a task needs a web page, open it in a real browser.
How to read a vendor by its patch record
Benchmark tables tell you how a coding agent performs on a good day. The disclosure timeline tells you what happens on a bad one, and it is the more useful signal when you are choosing a tool that will sit inside your repository for years.
| Signal | What it tells you | Who demonstrated it |
|---|
| Fixed before being told | Internal security review is actually running | GitHub Copilot |
| Fixed within a month | A functioning disclosure pipeline | Cursor |
| Disclosure declined | Triage disagreement, or a severity model you may not share | Microsoft (VS Code), Anthropic (initially) |
| No response in three months | No working external disclosure path | OpenAI (Codex) |
Frequently asked questions
What is the EMBRACE vulnerability?
EMBRACE is the name Forever Security gave to a shared root cause across five desktop AI assistants: an embedded browser trusted like a real one. The browsers inside these tools were given capabilities a normal browser does not have, which broke the browser security model. It affects Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop.
Is Cursor safe now?
The EMBRACE finding in Cursor was disclosed on 10 September 2026 and patched on 1 October 2026, so a build from 1 October or later carries the fix. The researchers describe it as silently patched, meaning there was no prominent advisory.
Is Codex patched?
No. Forever Security reported the issue to OpenAI on 27 July 2026 and records no response. It remained unpatched at the time the research was published, which is more than three months after disclosure.
Which AI coding tool handled this best?
GitHub Copilot. The address-bar spoof was fixed in version 1.1.29 on 13 October 2026 independently, before the researchers’ report arrived. Cursor is second, patching a code-execution path three weeks after disclosure.
Are there CVE numbers for these issues?
The research does not give CVE identifiers for the findings. Track them by product and version instead - Cursor from 1 October, Copilot from 1.1.29.
Should I stop using Codex or VS Code?
That depends on your exposure rather than on the flaw alone. The practical mitigation while no patch exists is to avoid using the tool’s embedded browser to open pages you have not vetted, particularly with a sensitive repository open, since the documented impact is a local file escaping its project folder and reading across the disk.
Related
Sources
Every figure on this page was read from the sources above on 30 October 2026. Where a vendor has not published a number, this page says so rather than repeating a third-party estimate.