EMBRACE research (Forever Security, Oct 29, 2026) showed the preview browser inside Cursor, Copilot, Codex, VS Code and Claude Desktop was trusted like a real browser — and shouldn't be. Codex and VS Code were unpatched at publication; Claude Desktop's fix status is uncertain. EmbedCheck audits your own workstation: a status table with a source and date on every row, update checklists, a workspace-trust guide, a canary self-test that never reads a real secret, plus policy and report templates.
Audit your own exposure surface: every agent panel, staging dashboard, and forgotten deploy. If it answers on the public internet without auth, that is the finding. Your domains only — never scan anyone else's infrastructure. PanelCheck is an own-domain panel and exposure audit kit: scope checklist, lockdown runbook, secrets-rotation template, auth-by-default guide, and one-page exposure report. $39 one-time.
Microsoft (Oct 19, 2026) announced Guardian Agents that "watch and moderate every action of every agent, before it happens, 24/7" — but published no implementation. Watchdog is the drill kit: a FastAPI guardian that scores every agent action and routes it to ALLOW, STEP-UP, HOLD-FOR-HUMAN, or HALT-AND-ISOLATE. Policy template, runbook, identity registry, risk rubric, containment playbook included. 17 tests passing. Not cost routing, not an audit — runtime supervision by safety.
