Vulnerability / research

EMBRACE research exposes trust gaps in embedded AI browsers

Reported

Published here

What happened

Controlled tests showed page-to-agent instruction injection in Cursor, address spoofing in Copilot, and local-file exposure in Codex and VS Code.

Parties and reporting

AI tools and systems: Cursor integrated browser, GitHub Copilot desktop browser preview, Codex desktop preview, VS Code integrated browser

Outcome

Forever reports Cursor and Copilot fixes, with Codex and VS Code unresolved on publication. No malicious exploitation is established. Microsoft disputes the VS Code finding under its Workspace Trust boundary.

Operating lesson

Keep untrusted previews isolated from local files and agent command approval. Verify URLs independently and avoid opening untrusted projects with broad host access.

Evidence and limits

October 29 is the verified public disclosure for these four findings; earlier researcher-to-vendor dates are private reports. The fifth product, Claude Desktop, overlaps already-recorded SneakPeek and is not counted again. Cursor required a user keystroke and model-dependent behavior; file access remains bounded by process permissions.

Sources