Security research exposes trust-boundary flaws in editor preview panes; Codex and VS Code unpatched

Forever Security published its EMBRACE research on October 29, 2026, documenting five security issues that share one root cause: the embedded preview pane inside popular AI coding tools was treated as if it carried a browser's guarantees when it did not. The findings, covered by The Register the same day, span Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. As of publication, Codex and VS Code were unpatched.

What the research found

According to Forever Security, researcher Gal Weizman reported five issues, none of which had a CVE identifier at publication time.

In Cursor, a web page could trigger code execution through the composer bridge. The agent acted on instructions hidden on the page, and the researchers' demonstration launched the Calculator application via a malicious package installation. The behavior was model-dependent and did not fire on every attempt. The researchers say they reported it on September 10, 2026, and that it was patched on October 1, 2026 with no advisory and no reply from the vendor.

GitHub Copilot up to version 1.1.27 allowed address-bar spoofing, letting a page present a fake sign-in form as github.com/login. Forever Security found this on September 26, 2026, but GitHub had already fixed it independently in version 1.1.29, released October 13, 2026, before any report was filed.

The broadest finding affected Codex, VS Code and Claude Desktop: a local HTML file opened in the embedded preview could read files outside the project folder. VS Code and Claude Desktop confined the page itself but not web workers the page could start, while Codex applied no folder check whatsoever. The researchers demonstrated reads of SSH keys, .env files and npm tokens.

Why the boundary fails

A standalone browser enforces origin and file-access rules: a web page cannot freely read files from disk, and a local file stays confined to its own directory. An embedded preview instead inherits the editor's trust in the workspace. It renders like a browser, but its effective permissions come from the editor's relationship to the project folder, so the security decision belongs to the workspace rather than to the web platform.

The worker-escape pattern shows how shallow that boundary is. If the page cannot leave the folder but a worker it starts can, the boundary only holds at the top level.

Vendor responses and patch status

Per the researchers, Microsoft and Anthropic declined the reports, citing Workspace Trust as an existing safeguard. Anthropic separately accepted a same-class report from Noma Security dated July 24, 2026. OpenAI did not respond to a July 27 report, according to Forever Security, but told The Register it is aware of the issue and working on a fix.

Claude Desktop's status is ambiguous: Forever Security no longer counts it among open flaws but has published no fix version or date, so it can fairly be called neither patched nor unpatched. All patch statuses were current only as of October 29, 2026, and may have changed since.

Checking your own setup

The practical guidance that follows from the findings is straightforward. Record each tool's installed version and compare it against the fixed versions above. Review workspace-trust settings so that untrusted folders stay in Restricted Mode, and prune the trusted-folder list of anything unrecognised or stale. Most importantly, avoid opening untrusted HTML in an embedded preview at all: a standalone browser is the component that actually enforces origin and file-access isolation. Because vendor statuses change, verify against release notes rather than relying on the October 29 snapshot.

Why it matters

Developers routinely open arbitrary repositories and preview arbitrary HTML, and the preview pane looks and behaves like a browser, which invites browser-grade assumptions about its safety. EMBRACE shows those assumptions are wrong: in three of the affected tools, a local file could reach SSH keys, environment files and package-manager tokens. The Cursor finding adds a second dimension, because in agentic tools a web page is also input to an AI agent that may act on instructions hidden within it. With two products unpatched at disclosure and vendors split on whether Workspace Trust is an adequate answer, the burden currently sits with users. Until fixes are verified, the embedded preview should be treated as an untrusted rendering surface, not a browser.