Forever Security reports that a page loaded into GitHub Copilot’s desktop preview could send a plugin browser-preview URL-change message indicating a trusted login origin even while the underlying document remained elsewhere. The mismatch mattered because the human address bar and the agent’s visible tab context could both consume the forged display rather…
Inspect the ClaimsCase · DiggingBeagle record
Copilot desktop preview could forge its displayed web origin
A browser-preview message altered the apparent origin shown to a human and an agent without a corresponding page navigation.
Scope
Affected desktop preview versions and attacker-controlled page content are required. The available report demonstrates origin spoofing, not confirmed theft or a server compromise.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Forever Security reproduced the preview mismatch in controlled tests and reported a repaired build, with no verified credential-theft victims. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-COPILOT-PREVIEW-ORIGIN-1 · EMBRACE: embedded AI-assistant browser attack paths
At a glance
This is displayed-origin and agent-context forgery, not documented password collection or TLS origin compromise.
Read the implicationsIndependent reproduction across patched builds is unavailable. No observed user credential submission or exfiltration is established.
Limits and uncertaintyFull account
Forever Security reports that a page loaded into GitHub Copilot’s desktop preview could send a plugin browser-preview URL-change message indicating a trusted login origin even while the underlying document remained elsewhere. The mismatch mattered because the human address bar and the agent’s visible tab context could both consume the forged display rather than the actual document location. A page that looks like a login screen is not proof that passwords were captured; the research demonstrates origin representation confusion.
The vendor-side repair was reportedly observed in desktop version 1.1.29 after a demonstration against 1.1.27. Reproduction needs to compare displayed URL, actual loaded document origin and what origin the agent treats as authoritative. Fixing the display alone must be evaluated separately from credential entry or tool authorization.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-COPILOT-PREVIEW-ORIGIN-1Forever Security demonstrated a GitHub Copilot desktop preview event that changed the displayed origin without navigating, and reported version 1.1.29 as fixed.supported
Basis: reported finding
- supportsEMBRACE: embedded AI-assistant browser attack pathsprimary disclosure
EMBRACE technical article, GitHub Copilot plugin:browser-preview URL-change demonstration and October 13 fix note
Implications
This is displayed-origin and agent-context forgery, not documented password collection or TLS origin compromise.
Controls and mitigations
- Separate document origin from display events; compare loaded origin, tab metadata and agent input in vulnerable 1.1.27 versus reported repaired 1.1.29.
Unknowns and contradictions
- Independent reproduction across patched builds is unavailable.
- No observed user credential submission or exfiltration is established.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208