In VS Code or OpenAI's Codex, a booby-trapped HTML file can hand over your SSH keys

A developer asks their AI assistant to install a project “as described in the README.” The assistant suggests a link to an HTML file in the project. One click, and the page opens in the tool's built-in browser. It then starts reading files on the computer: SSH keys, .env files containing secrets, npm tokens.

Forever Security reproduced this scenario and published it on October 29 under the name EMBRACE. Its researcher Gal Weizman examined the built-in browsers of five AI-assisted programming tools: Cursor, GitHub Copilot, OpenAI's Codex, Microsoft's VS Code and Anthropic's Claude Desktop. His conclusion: these browsers are given powers that a regular browser does not have, without keeping all of its protections.

What does each flaw allow?

• Codex: a local HTML file opened in the browser can read any file, with no folder restriction. Reported on July 27, with no response from OpenAI according to Forever. Not fixed.
• VS Code and Claude Desktop: the page is properly restricted to its folder, but a background script it launches (a “web worker”) escapes that limit.
• Cursor: a malicious page could get code executed, provided the user approved a command proposed by the agent, with the real command hidden behind a harmless-looking label. Success depended partly on the model. Fixed on October 1.
• GitHub Copilot: a page could display a fake address, for example that of the GitHub login page, which could fool both the user and the agent. GitHub fixed it on its own in version 1.1.29, on October 13.

Why do two vendors refuse to fix it?

Microsoft classified the report as invalid, citing Workspace Trust: by opening a project and trusting it, the user is supposed to accept the risk. Anthropic first responded the same way to Forever on July 23, before accepting a similar report from Noma Security the next day. Neither Forever nor Help Net Security says whether Claude Desktop is now fixed.

Gal Weizman disputes this reasoning, as quoted by Help Net Security: in his view, this trust prompt offers the user “no protection,” because refusing makes the tool unusable and everyone clicks “Trust.”

Forever sells AI security products, and its findings have not been verified by a third party.

What to do in the meantime?

Like the downloaded file that could control Codex and Claude Code, this attack relies on content opened within a project. Good habits:

• review the list of folders marked as “trusted” in VS Code and Codex, and remove projects pulled from the internet;
• do not open HTML files from an unknown repository in the built-in browser;
• do not leave SSH keys or .env files in plain text on development machines if a secrets vault can hold them;
• take inventory of the assistants installed on workstations: their built-in browser is an attack surface in its own right.

It remains to be seen whether OpenAI and Microsoft will change their minds now that the research is public.