Five widely used desktop AI assistants have been found to relax same-origin policy enforcement in their embedded browser components, creating a new class of host-code-execution and file-exfiltration vulnerabilities. The research is internally named EMBRACE (Embedded Browser in AI Runtimes as a Code Execution surface).
What EMBRACE is
Modern desktop AI assistants embed web browsers to render previews, documentation, and web-based tool outputs directly inside the assistant's interface. These embedded browsers operate under a relaxed security model compared to a standard browser. Same-origin policy restrictions are weakened or absent, communication channels between the browser context and the host application are broad, and the host filesystem is often directly accessible from browser-side JavaScript.
When a desktop AI assistant processes untrusted web content inside its embedded browser, any malicious script in that content can exploit these relaxed boundaries to escape the browser sandbox and reach the host system. The EMBRACE research demonstrates this across five tools in production use by software developers worldwide.
What the researchers found across five tools
- Cursor: Remote code execution on the host system. An attacker who can get Cursor to render a malicious page inside its embedded browser can execute arbitrary code with the privileges of the user running Cursor.
- Codex: File exfiltration. The embedded browser can read files from the host filesystem and transmit them to an external server. This includes source code, configuration files, and secrets stored locally.
- VS Code: File exfiltration through its built-in browser preview component, following the same vector as Codex.
- GitHub Copilot: Tab address spoofing. Malicious content can overwrite the address displayed in the embedded browser tab, enabling phishing attacks against the developer without leaving the IDE.
- Claude Desktop: The specific vector was not detailed in the public disclosure. Claude Desktop remains unpatched as of November 12, 2026.
Patch status
Cursor and GitHub Copilot have shipped patches. Codex, VS Code, and Claude Desktop remain unpatched. Developers who use these tools to browse or render web content in the AI assistant context should disable that functionality until a patch is available.
The practical risk
The attack surface exists wherever an AI assistant processes untrusted web content inside its embedded browser. This includes following a link from an AI-suggested resource, opening a preview of a documentation page, or rendering any web-based tool output. The malicious payload does not need to be on a site the developer navigates to intentionally.
Developers working with AI coding assistants routinely process content from public repositories, documentation sites, and third-party APIs. Any of these could serve as a delivery mechanism for an EMBRACE exploit if the assistant renders the content in its embedded browser. The researcher notes that standard SSRF and prompt injection defenses do not address this class of vulnerability because the payload executes in the browser context, not through the AI model.
What to do now
Apply patches for Cursor and GitHub Copilot immediately. For Codex, VS Code, and Claude Desktop, disable any features that render web content inside the AI assistant until patches are available. Review your AI assistant's settings for options that control embedded browser behavior and restrict them to trusted origins only. Treat AI assistant tooling as software with an attack surface equivalent to a web browser: it needs the same update discipline and the same content isolation controls.