EMBRACE flaws hit 5 AI coding tools; Codex and VS Code unpatched
Embedded-browser bugs let a page run commands or read local files. Plus a shared AI-training opt-out token, and Vercel AI SDK goes stable.
Copy markdown
Your editor's browser isn't a real browser
Forever Security's Gal Weizman showed the embedded browsers in Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop each dropped a rule a standalone browser enforces, so a malicious page gets powers a tab shouldn't have. In the demo, one local HTML file ran a host command inside Cursor and, via the disk-read bug, lifted SSH keys, .env files, and npm tokens straight off the machine.
Cursor and Copilot patched; Codex and VS Code didn't
Cursor fixed it quietly on Oct 1 and GitHub shipped Copilot 1.1.29 on Oct 13, but OpenAI (Codex, reported July 27) and Microsoft (VS Code, reported Sept 10) marked the disk-read flaw invalid under "workspace trust" and were still unpatched at publication — roughly 45M combined installs. Until a fix lands, don't open untrusted repos or preview unknown web pages inside Codex or VS Code.
One robots.txt line opts your site out of AI training
OpenAI, Google, Microsoft, and Anthropic said Oct 30 they'll honor a shared `__usage_ai-training` token: add `User-Agent: __usage_ai-training` then `Disallow: /` to robots.txt to opt a site out of training. Anthropic is implementing now, OpenAI "in the coming months," Microsoft by Feb 1 2027, Google in 2027 — and it covers training only, so crawling and live grounding stay separate and non-compliant scrapers can still ignore it.
Vercel AI SDK: tool filtering and stream types go stable
The AI SDK dropped the experimental prefix on `filterActiveTools` (Oct 29) and made `LanguageModelStreamPart` a stable type, so you can gate which tools a model sees per request and handle typed streams without experimental caveats. Reasoning options now pass through per provider too, warning you instead of silently dropping an unsupported `none`.