Forever publishes EMBRACE findings on embedded AI browsers

What the public record establishes

Forever published the grouped research on October 29. Its Cursor demonstration required a user keystroke and depended on model behavior; it reported a patch on October 1 after a September report. Copilot’s address-spoofing issue was fixed independently in build 1.1.29 on October 13, before Forever sent a report. [2]

Forever reported local-file exposure in Codex and VS Code as unresolved at publication. Microsoft rejected the VS Code report under its Workspace Trust boundary; Forever said OpenAI had not replied to its private report. These were researcher demonstrations, not reported malicious exploitation. [2][3]