Cursor、GitHub Copilot 等五款 AI 編碼工具的內置瀏覽器曝出 EMBRACE 漏洞

Security researchers published a class of flaws this week in the browsers embedded inside five AI coding tools: Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop. A rigged web page or a local HTML file could run code, fake the address bar, or read files outside the project folder.

Two of the five had no fix as of 29 October. That is the part to act on.

What EMBRACE actually is

The research, published by Forever Security and reported by Hackread and Help Net Security, names the class EMBRACE: embedded browser, trusted like a real one.

The design makes sense on paper. These tools now ship a small browser inside the editor so a model can read documentation or preview a page it just wrote. That browser was treated as trusted, which is exactly the assumption an attacker needs.

What the researchers got, tool by tool:

• Cursor: a page got attacker code to run.
• GitHub Copilot: a page could render a fake address bar, which makes phishing trivial.
• Codex, VS Code and Claude Desktop: a single local HTML file opened in the tool could read files beyond the project boundary.

That last one is how SSH keys, cloud credentials and .env files leave a machine.

Why it matters more than a normal CVE

Most developers who use these tools behave the same way: clone a repository, open it, let the assistant read the folder. If the project contains a crafted HTML file, the file is inside the trusted boundary the moment the workspace opens.

The disclosure timeline makes it worse. Researchers reported the Codex issue to OpenAI on 27 July and the VS Code issue to Microsoft on 10 September. As of 29 October, both were still unfixed. Anthropic and Microsoft declined the reports and pointed at Workspace Trust, the prompt that asks you to confirm you trust a folder.

That argument is circular in practice: the trust prompt is exactly the click a malicious project needs.

What to do today

Treat a cloned repository the way you treat an email attachment.

1. Open untrusted projects in a container or a throwaway VM first.
2. Do not click "trust" on a folder you have not looked inside. List the HTML files before you trust it.
3. Pull the trusted-project list from each machine's config and audit it. Anything in that list with an HTML file you did not write deserves a second look.
4. Rotate any credential that was sitting on a machine where you opened an untrusted project with Codex or VS Code.
5. Watch for the fixes and update when they land, if they have not already.

How an attack would actually run

Nothing exotic is required. A maintainer of a small open source project, or anyone who can get a pull request merged, adds an HTML file. It looks like a documentation preview, a test fixture, or a demo page.

You clone the repo and open the folder. The assistant, doing its job, reads the workspace. The page loads inside the embedded browser. From there it can reach the local files the tool can reach, and the tool can reach everything your user account can.

The last step is the quiet one: nothing crashes, nothing obvious appears, and the file is exfiltrated in a normal-looking request. Credentials leave, the project looks fine, and you find out weeks later when a bill or a build pipeline behaves strangely.

What vendors said

Anthropic and Microsoft both declined the reports, citing Workspace Trust. The researchers disagree with that reasoning, because the trust prompt is user-controlled and a project can be crafted to make trusting it look reasonable.

OpenAI and Microsoft were given the Codex and VS Code reports in July and September respectively. The gap between disclosure and fix is the number that matters for anyone running those tools today.

A five minute checklist for teams

• Which AI coding tools are installed across the team, and which versions?
• Which projects are marked as trusted, and does any of them contain HTML you did not author?
• Are credentials on developer machines scoped to the project, or to the whole account?
• Is there a rule that untrusted repos get opened in a container first?

If you cannot answer the first two from memory, that is the finding.

The bigger pattern

This is the third month in a row where the interesting AI security story is not about a model being clever. It is about the plumbing around the model being trusted by default.

Agents and coding assistants are being given more access, not less: to files, to terminals, to browsers. Each new surface is another place where "trusted because it is local" turns out to be a guess. The teams that come out of this fine are the ones that treat every new integration as untrusted until it proves otherwise.

Full note with sources: voxahq.in. No affiliate links, no sponsored rankings.