How the built-in browsers in five AI coding tools broke basic browser rules
Comments on “How the built-in browsers in five AI coding tools broke basic browser rules”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Forever Security's EMBRACE research says the built-in browsers in five AI coding tools broke basic browser rules. Cursor's agent could receive commands from a web page, the Copilot app's address bar could be spoofed, and local HTML in Codex, VS Code and Claude Desktop could read files outside the project. Cursor and Copilot are patched; Codex and VS Code were not as of October 29, and Claude Desktop's status is unclear. Results are the researchers' own testing, and the Cursor attack is probabilistic.
Why it ranked
No. 5 of 59 with a score of 0.77. The panel rated it highest on practical relevance (0.89) and reader interest (0.87), lowest on significance (0.68). Placed No. 5, No. 2 by score alone: the fourth Security story of the day (−0.020), and close to “Embrace: RCE, Address Bar Spoofing and More in Cursor, Codex, Copilot and Claude”, No. 30 on Friday 30 October 2026 (−0.043). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Detailed security research on AI coding tools' embedded browsers with reproducible exploit details, vendor patch status, and a practical grep-based detection method; mostly self-reported testing, some vendor claims unverified.
- AI judgeJudge 3gpt-5.6-luna
- A timely, technically detailed security explainer covering exploitable embedded-browser failures across widely used AI coding tools, with reproduction concepts, affected versions, mitigations, and a practical triage search; evidence is secondary but unusually specific.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.3
- Significance0.68
- Reader interest0.87
- Audience breadth0.71
- Practical relevance0.89
- Substantiated0.75
- Technical depth0.80
- New information0.85
- Counts against: Promotional0.04
- Counts against: Overclaim0.19
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.60 | 0.72 | 0.68 | 0.12 | +0.24 | +0.163 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.84 | 0.88 | 0.90 | 0.87 | 0.06 | +0.26 | +0.227 |
| Audience breadthHow many people who build technology does it concern? | 0.67 | 0.70 | 0.76 | 0.71 | 0.09 | +0.13 | +0.092 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.95 | 0.85 | 0.86 | 0.89 | 0.10 | +0.22 | +0.195 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.76 | 0.72 | 0.78 | 0.75 | 0.06 | +0.05 | +0.038 |
| Technical depthHow technically substantive is it? | 0.88 | 0.80 | 0.72 | 0.80 | 0.16 | +0.05 | +0.040 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.82 | 0.75 | 0.98 | 0.85 | 0.23 | +0.05 | +0.043 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.03 | 0.03 | 0.04 | 0.03 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.29 | 0.20 | 0.08 | 0.19 | 0.21 | −0.11 | −0.021 |
| Sum of contributions | +0.769 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.769 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-01/5/"><img src="https://rubric.hrih.si/badge/2026-11-01/5.svg" alt="Ranked #5 on Rubric, 1 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 6 matches source · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
Forever Security published EMBRACE research on October 29, 2026, showing that the browsers built into five AI coding tools could run commands, read the whole disk or fake the address bar.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On October 29, 2026, Forever Security published EMBRACE, research showing that the browsers built into five AI coding tools could run commands, read the whole disk or fake the address…”
The source says No passage could be compared.
Source cited by the article: forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical
Matches sourceCausal conclusion
Cursor's built-in browser exposes window.cursorBrowser.send to every site, which a site can call without a click to feed the agent's composer.
The cited source says the same thing.
The article says “Cursor's built-in browser exposes an object, window.cursorBrowser.send, to every site you open, and a site can call it without a click”
The source says “A page can call window.cursorBrowser.send(...), and that call reaches the agent’s composer - the text box the agent reads as instruction. It is exposed to every page, any origin, no…”
Source cited by the article: forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical
Matches sourceDate
Forever Security reported the Cursor issue on September 10 and says Cursor patched it on October 1 without replying.
The cited source says the same thing.
The article says “They reported it on September 10 and say Cursor patched it on October 1 without replying”
The source says “September 10th - disclosed to Cursor. - October 1st - vulnerability silently patched. - Cursor never reached back”
Source cited by the article: forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical
Matches sourceNumber
In Codex's preview, a plain fetch of a file:// path returned the file's contents, with no folder check.
The cited source says the same thing.
The article says “The researchers found that in Codex's preview a plain fetch of a file:// path returned the file's contents”
The source says “Codex put no file-read fence on the page in the first place, so a plain read straight from the top document already returns any file on the machine”
Source cited by the article: forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical
Matches sourceCausal conclusion
VS Code and Claude Desktop checked that the page stayed inside the project folder but only for the main page, not web workers, so a blob-built worker could read outside the project.
The cited source says the same thing.
The article says “But the check covered only the main page, not web workers, the background scripts a page can start”
The source says “The project-scope fetch fence runs in the top document. It does not run inside a web worker”
Source cited by the article: forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical
Matches sourceVersion
The GitHub Copilot app flaw was found on September 26 in version 1.1.27, and GitHub fixed it on its own in 1.1.29 on October 13, before a report was sent.
The cited source says the same thing.
The article says “GitHub fixed it on its own in 1.1.29 on October 13, before a report was sent”
The source says “September 26th - address bar spoof found and confirmed on GitHub Copilot 1.1.27. - October 13th - GitHub fixed it independently in a later Copilot build (1.1.29), before we had…”
Source cited by the article: forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical
Couldn’t checkQuote
Gal Weizman told Help Net Security that Workspace Trust gives the user no protection here, because opening the project was already the user's choice.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Weizman told Help Net Security that the prompt gives the user no protection here, because opening the project was already the user's choice”
The source says No passage could be compared.
Source cited by the article: helpnetsecurity.com/2026/10/29/research-ai-assistant-browser-vulnerabilities
Matches sourceDate
Codex was reported July 27 with no response, and Codex and VS Code remained unpatched as of October 29; Microsoft declined the VS Code report citing Workspace Trust.
The cited source says the same thing.
The article says “Codex: reported July 27, no response, unpatched as of October 29”
The source says “July 27th - disclosed to OpenAI; never heard back. Still unpatched”
Source cited by the article: forever.security/blog/embrace-hacking-5-ai-assistants-embedded-browsers-technical
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 1 Nov 2026, 05:47 UTC. It played no part in the ranking.