· ai-devtools
AI Coding Assistants' Built-In Browsers Open a Path to Developer Secrets
Developers have spent years learning not to trust what they open in a browser.
Their AI coding assistants haven't learned the same lesson. Researchers at Forever Security found that the browsers built into five popular AI coding tools give web content far more reach into the host machine than a standalone browser would allow. Researcher Gal Weizman calls the flaw class EMBRACE, short for "embedded browser, trusted like a real one."
Two of the tools are still exposed. 29, the researchers say the flaws in Codex and VS Code remain unpatched. The root cause is a design choice, not a single coding mistake.
A regular browser treats every page as hostile. It won't let a page run commands on your computer. It won't let a local file read your other files.
And it alone controls what appears in the address bar. Each vendor relaxed at least one of those rules so the AI assistant could preview a project or read what's in a tab. In Cursor, a malicious web page could reach the agent's command composer through a bridge between the embedded browser and the assistant. Hidden instructions on the page led the agent to run an install command that, in the researchers' demo, rolled out Calculator on the host.
