{"schema_version":"0.10.0","id":"LR-2026-0296","record_version":2,"title":"EMBRACE: Codex embedded browser reads files outside the project via malicious HTML","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.72,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-31","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Only a republished copy: BigGo Finance · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":1,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-31","history":[{"date":"2026-10-31","from_level":null,"to_level":"preliminary","reason":"Only a republished copy: BigGo Finance · subject to change"}]},"sources_hash":"69389ddd6f8f36cf2271792a0c22feea634c1b4bc4026d948d15f47f054dbad7"},"system":{"model_name":null,"model_version":null,"developer":"OpenAI","harness":"Codex desktop app embedded browser","tools_granted":[],"permissions_scope":"Embedded browser granted more privileges than a normal browser, including reach into the host environment and reading of files outside the project.","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":"provider","lifecycle_stage":"production","integration_type":"embedded","intended_use":"AI coding assistance with an embedded browser for checking AI-generated previews.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-30","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Forever Security researchers led by Gal Weizman investigated the embedded browsers in five AI coding-assistance desktop apps, including OpenAI's Codex.","tags":[],"date_detected":null,"near_miss":true,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"A page delivered an invisible malicious instruction into the AI's input field, causing the AI to execute a command.","responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":"A malicious HTML file opened in the embedded browser, and in Cursor a page sending an invisible instruction into the AI's input field.","time_to_contain":null,"operations_paused":null,"remediation":"Cursor fixed the command-execution issue on October 1; GitHub fixed the Copilot address-spoofing issue on October 13 in version 1.1.29.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate, because data or systems of others touched, with a bounded scope stated: Researchers read authentication keys and tokens on their own Macs, a bounded scope, with no user harm count stated.","harm_class":["third_party_security"],"affected_description":"Embedded browsers of Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop; researchers' own Macs.","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://finance.biggo.com/news/85724287-c077-41b9-ac46-b788a975ab0a","publisher":"BigGo Finance","date":"2026-10-30","type":"press","title":"Common Vulnerability Found in 5 AI Development Tools; Codex and VS Code Remain Unpatched — BigGo Finance","archived_url":null,"attachment":"first_report","independence":"derivative"}],"per_field_confidence":{"system.harness":"C","system.permissions_scope":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"C","system.intended_use":"C","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.failure_class":"D","event.near_miss":"C","event.responsible_party":"D","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"C","event.trigger":"C","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.detection_method":"D","impact.harm_class":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"C","context.systemic_exposure":"C","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"OpenAI's \"Codex\" and Microsoft's \"Visual Studio Code (VS Code)\" remained unpatched at the time of disclosure, and opening a malicious HTML file could allow files outside the project to be read."}],"system.harness":[{"source_index":0,"quote":"A research team led by Gal Weizman of the firm investigated the browsers built into the desktop apps of five products: Cursor, GitHub Copilot, Codex, VS Code, and Anthropic's \"Claude Desktop.\""}],"system.permissions_scope":[{"source_index":0,"quote":"The core of the problem lies in the fact that each tool grants its embedded browser more privileges than a normal browser."},{"source_index":0,"quote":"In Codex, files outside the project could be read directly from an opened HTML file."}],"system.deployment_context":[{"source_index":0,"quote":"AI coding-assistance tools have spread rapidly over the past year and are becoming a standard working environment at development sites."}],"system.lifecycle_stage":[{"source_index":0,"quote":"AI coding-assistance tools have spread rapidly over the past year and are becoming a standard working environment at development sites."}],"system.integration_type":[{"source_index":0,"quote":"A research team led by Gal Weizman of the firm investigated the browsers built into the desktop apps of five products: Cursor, GitHub Copilot, Codex, VS Code, and Anthropic's \"Claude Desktop.\""}],"system.intended_use":[{"source_index":0,"quote":"Embedded browsers are marketed for the convenience of checking AI-generated previews on the spot, while the apps are given privileges that ordinary browsers do not have."}],"event.failure_class":[{"source_index":0,"quote":"In Cursor, the team demonstrated a technique in which a page sends a malicious instruction, invisible on screen, into the AI's input field, causing the AI to execute a command."}],"event.trigger":[{"source_index":0,"quote":"In Cursor, the team demonstrated a technique in which a page sends a malicious instruction, invisible on screen, into the AI's input field, causing the AI to execute a command."}],"event.near_miss":[{"source_index":0,"quote":"The latest report is based on demonstrations in the researchers' own environments and does not indicate the number of users harmed by this technique."}],"event.responsible_party":[{"source_index":0,"quote":"OpenAI's \"Codex\" and Microsoft's \"Visual Studio Code (VS Code)\" remained unpatched at the time of disclosure, and opening a malicious HTML file could allow files outside the project to be read."}],"event.adversarial_actor":[{"source_index":0,"quote":"For an attack to succeed, the user must open a malicious HTML file in the embedded browser."}],"event.input_provenance":[{"source_index":0,"quote":"For an attack to succeed, the user must open a malicious HTML file in the embedded browser."}],"event.remediation":[{"source_index":0,"quote":"GitHub fixed it on October 13 in version 1.1.29."}],"event.incident_class":[{"source_index":0,"quote":"For an attack to succeed, the user must open a malicious HTML file in the embedded browser."}],"event.agent_involved":[{"source_index":0,"quote":"Specifically, he explained that three aspects—the input path to the AI agent, the authority to determine a tab's address, and the reach into the host environment—blurred the boundaries."}],"event.failure_class_detail":[{"source_index":0,"quote":"In Cursor, the team demonstrated a technique in which a page sends a malicious instruction, invisible on screen, into the AI's input field, causing the AI to execute a command."}],"impact.affected_description":[{"source_index":0,"quote":"A research team led by Gal Weizman of the firm investigated the browsers built into the desktop apps of five products: Cursor, GitHub Copilot, Codex, VS Code, and Anthropic's \"Claude Desktop.\""}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The research team confirmed on its own Macs that it could read connection-authentication keys, development authentication tokens, and other data."}],"impact.harm_class":[{"source_index":0,"quote":"The research team confirmed on its own Macs that it could read connection-authentication keys, development authentication tokens, and other data."}],"context.industry":[{"source_index":0,"quote":"AI coding-assistance tools have spread rapidly over the past year and are becoming a standard working environment at development sites."}],"context.systemic_exposure":[{"source_index":0,"quote":"The latest issues show that a design that relaxed the conventional threat model in exchange for convenience has produced similar holes across multiple vendors."}],"event.summary":[{"source_index":0,"quote":"A research team led by Gal Weizman of the firm investigated the browsers built into the desktop apps of five products: Cursor, GitHub Copilot, Codex, VS Code, and Anthropic's \"Claude Desktop.\""}],"impact.severity":[{"source_index":0,"quote":"The research team confirmed on its own Macs that it could read connection-authentication keys, development authentication tokens, and other data."}],"impact.severity_because":[{"source_index":0,"quote":"The research team confirmed on its own Macs that it could read connection-authentication keys, development authentication tokens, and other data."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-30"}]},"notes_on_gaps":"Only one source (press). No date_occurred stated; only disclosure date 2026-10-29. No detection_method stated: the researchers investigated and disclosed, but no source says who first noticed or by what signal, so detection_method omitted. No autonomy_level stated. No tools_granted, guardrails_present, safeguard_state, model_version, country, org_size_band, records_exposed, direct_loss_usd, third_parties_affected_count stated. failure_class injection_triggered and trigger prompt_injection rest on the Cursor demonstration, not Codex specifically; Codex's own vector is a malicious HTML file read. incident_class security_compromise rests on the malicious-file attack path. severity moderate is grade D judgement from the credentials-read fact; no loss figure given. systemic_exposure true rests on the shared design across vendors. event.summary sentences each cited. event.root_cause: the stated reason names an absence, not a failed control: Embedded browsers were granted privileges beyond a normal browser's boundaries, and the file-read restriction did not extend to Web Workers. system.tier: provider by rule (the developer is named as the operator). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-31] system.lifecycle_stage: production. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.responsible_party: provider. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.summary: classified from described behaviour. event.detection_method: no source says who first noticed. impact.harm_class: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":"Software development tools","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":true,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Five AI coding-assistance desktop tools, including OpenAI's Codex, ran embedded browsers with more privileges than a normal browser, reaching into the host environment and the AI agent's input path.","quote":"The core of the problem lies in the fact that each tool grants its embedded browser more privileges than a normal browser.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Opening a malicious HTML file let files outside the project be read, and in Cursor an invisible instruction sent into the AI's input field made the AI execute a command, crossing the boundary a normal browser enforces.","quote":"In Codex, files outside the project could be read directly from an opened HTML file.","source_index":0,"grade":"C"},{"step":"reached","text":"Researchers read connection-authentication keys and development authentication tokens on their own Macs; the report does not state how many users were harmed.","quote":"The research team confirmed on its own Macs that it could read connection-authentication keys, development authentication tokens, and other data.","source_index":0,"grade":"C"},{"step":"caught","text":"A research team led by Gal Weizman of Forever Security investigated the embedded browsers and disclosed the issues on October 29.","quote":"A research team led by Gal Weizman of the firm investigated the browsers built into the desktop apps of five products: Cursor, GitHub Copilot, Codex, VS Code, and Anthropic's \"Claude Desktop.\"","source_index":0,"grade":"C"},{"step":"done","text":"Cursor fixed its issue October 1 and GitHub fixed Copilot on October 13 in version 1.1.29; Codex and VS Code remained unpatched at disclosure.","quote":"OpenAI's \"Codex\" and Microsoft's \"Visual Studio Code (VS Code)\" remained unpatched at the time of disclosure, and opening a malicious HTML file could allow files outside the project to be read.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-31","source_urls":["https://finance.biggo.com/news/85724287-c077-41b9-ac46-b788a975ab0a"]}}