Embedded browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop flawed
Forever Security’s EMBRACE findings show prompt injection, address spoofing, and local file reads; Codex and VS Code were still unpatched.
74
Organization
Forever Security
- Mentions · 7d5
- Mentions · 30d10
- All mentions14
- First seenSep 16, 2026
- Last mentioned3d ago
Timeline
14 articles · newest firstResearchers find 'Embrace' embedded-browser flaws in five AI coding tools; Codex and VS Code unpatched
Flaws in Codex and VS Code remain unpatched; Cursor silently fixed code execution and GitHub fixed Copilot spoofing in 1.1.29.
72
Embedded browsers in five AI coding tools can leak files or run code
As of October 29, Codex and VS Code still let one local HTML click read SSH keys, tokens and .env files.
74
Malicious AGENTS.md tried to hijack coding agents
Forever Security says a planted markdown file on a customer PC could push Codex to install malware or leak tokens, and was stopped before code ran.
74
Malicious Downloads files can hijack Codex and Claude Code
Forever Security says a planted AGENTS.md or CLAUDE.md can change agent settings, install an npm package, or expose an OAuth token.
66
Downloads-folder instruction files steer Codex and Claude Code
In Forever Security tests, Codex followed the planted file in more than 90% of attempts and Claude exposed a login token about half the time.
62
Malicious AGENTS.md files can hijack AI coding agents into running malware and leaking tokens
Poisoned Markdown instruction files let agents alter MCP configuration, bypass approvals and leak OAuth tokens; one real attempt was blocked at a customer.
55
Planted Downloads files can hijack Claude Code and Codex agents
Forever Security says a planted AGENTS.md made Codex install MALFEX package function-color in over 90 percent of tests.
64
Downloads-folder instruction file tried to make a coding agent install malware
Forever stopped the agent before code ran; Codex followed the planted file in more than 90% of isolated tests.
66
Malicious AGENTS.md files in Downloads hijack Codex and Claude Code
A customer agent tried to install npm package function-color; tests also stole Claude Code OAuth tokens in about half of runs.
63
BragJack Attack Hijacks AI Assistants in 5 Popular Browsers With Zero Clicks
Researchers disclosed BragJack, a zero-click extension attack hijacking AI assistants in Chrome, Edge, Opera, Comet, and Claude.
68
BragJack attacks hijack AI browser agents through malicious extensions
Forever Security's Gal Weizman disclosed BragJack, a malicious-extension technique hijacking AI browser agents from Chrome Gemini to Claude, earning $20,000 in bounties.
65
BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers
Researchers demonstrated 'BragJack' browser-extension attacks that hijack AI agents in Chrome, Edge, Comet, Opera Neon, and Claude, leading to two CVEs and vendor patches.
68
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Researchers showed a single browser extension could hijack AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome, earning $20,000 in bounties.
62
Related CVEs
by mentions- CVE-2026-06287%8.8Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious…
- CVE-2026-55945<1%4.2Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to…
Appears with
- Anthropicvendor · 13
- OpenAIvendor · 10
- Codexproduct · 7
- Microsoftvendor · 7
- Claude Codeproduct · 6
- Claude in Chromeproduct · 4
- Microsoft Edgeproduct · 4
- Operavendor · 4
- Opera Neonproduct · 4
- Perplexityvendor · 4
- function-colormalware · 4
- Claudeai model · 4
- Googlevendor · 4
- MALFEXmalware · 3
- VS Codeproduct · 3
- GitHubvendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.