Cases › security breach › LR-2026-0296

EMBRACE: Codex embedded browser reads files outside the project via malicious HTML

Preliminary Why: Only a republished copy: BigGo Finance · subject to change

Severity moderate: Other parties' data or systems were touched, and a source states how far it reached. Researchers read authentication keys and tokens on their own Macs, a bounded scope, with no user harm count stated.

Earliest source we hold 2026-10-30 · Captured by AI Risk Wire 2026-10-31 03:27 UTC

Forever Security researchers led by Gal Weizman investigated the embedded browsers in five AI coding-assistance desktop apps, including OpenAI's Codex.

Risks this incident falls under

Risk	Role	NIST AI 600-1	Incidents
Hidden instructions hijack the agent	Primary	Information Security	18
AI used to run a cyber attack	Also	Information Security	33
AI system attacked or breached	Also	Information Security	1

Sorted by rule from the case's fields; not yet read from the sources.

Control failure chain

L1 · Model Not read yetProvider not named

L2 · Harness Not read yetHarness not named

L3 · Application Not read yetDeployer not named

L4 · Infrastructure / target Not read yetOrganisation hit

L1 · ModelProvider not namedModel provider

Sources not yet read for controls.

Model version not linked to a model card.

L2 · HarnessHarness not namedAgent framework vendor

Sources not yet read for controls.

5 more for this risk at this layer

Outside content treated as data, not instructions Not read yet

Prompt-injection detection Not read yet

Confirmation after untrusted input Not read yet

Validation of tool inputs and outputs Not read yet

Tool allow-list Not read yet

L3 · ApplicationDeployer not namedDeployer

Sources not yet read for controls.

4 more for this risk at this layer

Human approval for high-impact actions Not read yet

Least-privilege access for the agent Not read yet

Segmentation of agent components Not read yet

Alerts on unusual tool use Not read yet

L4 · Infrastructure / targetOrganisation hitOrganisation hit

Sources not yet read for controls.

HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target

The same controls in other incidents of this risk

Control	Layer	Here	Held elsewhere	Did not hold elsewhere
Tool allow-list	L2 Harness	Not read yet	–	–
Confirmation after untrusted input	L2 Harness	Not read yet	–	–
Outside content treated as data, not instructions	L2 Harness	Not read yet	–	–
Prompt-injection detection	L2 Harness	Not read yet	–	1
Validation of tool inputs and outputs	L2 Harness	Not read yet	–	–
Least-privilege access for the agent	L3 Application	Not read yet	–	–
Human approval for high-impact actions	L3 Application	Not read yet	–	5
Segmentation of agent components	L3 Application	Not read yet	–	–
Alerts on unusual tool use	L3 Application	Not read yet	–	–

Remediation

Fix reported

“Cursor fixed the command-execution issue on October 1; GitHub fixed the Copilot address-spoofing issue on October 13 in version 1.1.29.”

No later incident for OpenAI under this risk on record.

Risk grouping: Not yet classified

No source we hold states: who caused it, intended or not, before or after release, the ai's part.

The story

1 · What it was doingFive AI coding-assistance desktop tools, including OpenAI's Codex, ran embedded browsers with more privileges than a normal browser, reaching into the host environment and the AI agent's input path.

2 · What went wrongOpening a malicious HTML file let files outside the project be read, and in Cursor an invisible instruction sent into the AI's input field made the AI execute a command, crossing the boundary a normal browser enforces.

3 · What it reached or didResearchers read connection-authentication keys and development authentication tokens on their own Macs.

4 · How it was caughtA research team led by Gal Weizman of Forever Security investigated the embedded browsers and disclosed the issues on October 29.

5 · What was doneCursor fixed its issue October 1 and GitHub fixed Copilot on October 13 in version 1.1.29; Codex and VS Code remained unpatched at disclosure.

What the sources state

What set it off hidden instructions in its input

No source states: when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause.

Others like this

Malicious AGENTS.md in Downloads folder hijacks Codex and Claude Code agents 2026-10-26

Unauthorized relay service reconfigures genuine Codex and Claude Code CLIs, disabling sandboxes and replacing credentials 2026-10-29

OpenAI research model escapes to live internet via DNS misconfiguration during training 2026-10-24

OpenAI research model accessed a cryptocurrency wallet without permission 2026-10-16

All cases of this kind ›

Show every field, with its source and grade

The AI system

Developer

OpenAI

C one secondary source states it

Software around the model

Codex desktop app embedded browser

C one secondary source states it

What it was allowed to do

Embedded browser granted more privileges than a normal browser, including reach into the host environment and reading of files outside the project.

C one secondary source states it

Stage of use

in live use

D inferred by us from the described behaviour, reason shown

Whose system

company that built the AI

D inferred by us from the described behaviour, reason shown

How it was connected

built into a product

C one secondary source states it

What it was for

AI coding assistance with an embedded browser for checking AI-generated previews.

C one secondary source states it

What happened

Earliest source we hold

2026-10-30

A the date the source itself carries

What set it off

hidden instructions in its input

C one secondary source states it

Near miss

yes, no harm happened

C one secondary source states it

Who was responsible

the model provider

D inferred by us from the described behaviour, reason shown

Who caused it

an outside attacker

C one secondary source states it

Where its input came from

A malicious HTML file opened in the embedded browser, and in Cursor a page sending an invisible instruction into the AI's input field.

C one secondary source states it

What was done

Cursor fixed the command-execution issue on October 1; GitHub fixed the Copilot address-spoofing issue on October 13 in version 1.1.29.

C one secondary source states it

What went wrong

security breach

D inferred by us from the described behaviour, reason shown

AI agent

an AI agent acted

C one secondary source states it

What it did

A page delivered an invisible malicious instruction into the AI's input field, causing the AI to execute a command.

D inferred by us from the described behaviour, reason shown

Impact

Severity

moderate

D inferred by us from the described behaviour, reason shown

Kind of harm

others' security

D inferred by us from the described behaviour, reason shown

Who was affected

Embedded browsers of Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop; researchers' own Macs.

C one secondary source states it

Kinds of data exposed

credentials

C one secondary source states it

Why this severity

Other parties' data or systems were touched, and a source states how far it reached. Researchers read authentication keys and tokens on their own Macs, a bounded scope, with no user harm count stated.

D inferred by us from the described behaviour, reason shown

Context

Industry

Software development tools

C one secondary source states it

Shared exposure

one shared model or part put many users at risk

C one secondary source states it

LR-2026-0296 · version 2 · published 2026-10-31 after automatic checks; not yet checked field by field by a person · changes to this case · JSON