Five coding assistants that run on a Mac shipped a browser with rules loosened just enough to let a hostile page through. A security team broke every one, and two vendors still lack a fix.
One relaxation, three ways out
A normal browser treats every page as an enemy. Each assistant bent that assumption so its preview pane could do useful work, and each bend handed a stranger a path it should not have had. Forever Security, which studied Cursor, GitHub Copilot, Codex, Visual Studio Code and Claude Desktop, calls the pattern EMBRACE, an embedded browser trusted as one.
The paths diverge from there. Should a local page open in the built-in view of Claude Desktop, Codex or VS Code, it slips out through a background worker thread and reaches files outside the project folder. On a shared Mac, one harmless HTML file reads the whole disk.
Anthropic heard the Claude Desktop case in July and rejected it, treating workspace trust as the boundary. A fortnight on, Noma Security walked the identical finding through the same door and it was accepted. OpenAI has sat on the Codex bug since July 27 and says work continues; Microsoft threw out the VS Code case for the same reason. Treat a downloaded page opened in these three as hostile, because not one has a patch.
Two that patched
Cursor moved quietly. A prompt injection route reported on September 10, where a page tells the agent to run commands through a channel the person never sees, was closed October 1 with no advisory. Copilot’s spoofed address bar went in 1.1.29; GitHub maintains the report never arrived.
Updating those two closes the known paths. The rest still read local files on request, so keep their preview windows clear of documents you did not write.
