The report
A page opened inside an AI assistant is not necessarily confined to the same powers as a conventional browser tab. In its October 29 EMBRACE report, Forever Security documented three distinct failure paths across desktop assistants: Cursor's page-to-agent bridge, local file handling in Codex, Claude Desktop and VS Code, and a spoofed tab origin in GitHub Copilot. These are controlled demonstrations, not a count of compromised users.
Which boundary moved?
| Affected context | Attacker-controlled input | Observed boundary failure |
|---|---|---|
| Cursor integrated browser | Page-supplied element-selected attributes |
Hidden page attributes reached an agent command workflow, with a demonstrated host-code execution path |
| Codex, Claude Desktop and VS Code previews | A malicious local HTML document | File-scheme requests read outside intended project limits; Codex's top-level page and the other products' worker contexts differed |
| GitHub Copilot desktop preview | A page-generated URL-change event | A displayed GitHub login origin could be forged without corresponding navigation |
The local-file experiments required the victim to open a malicious local document. The Cursor command demonstration involved an agent-generated execution path and user interaction; the Copilot origin demonstration was not verified credential theft. The research describes different patch states and does not establish one fixed version for every application. See the separate Cursor bridge investigation, local-file investigation and origin-spoof investigation.
What needs verification
A file-read test must check top-level documents, subframes and workers separately; an agent-command test must verify that untrusted page metadata cannot enter an executable instruction channel; an origin test must compare displayed origin with the browser's actual committed navigation. The technical disclosure supports those distinct cases, not a blanket claim that every web page can compromise every assistant.