Launching today
EmbedCheck
Audit the preview browser inside your AI coding tools
0 followers
Audit the preview browser inside your AI coding tools
0 followers
EMBRACE research (Forever Security, Oct 29, 2026) showed the preview browser inside Cursor, Copilot, Codex, VS Code and Claude Desktop was trusted like a real browser — and shouldn't be. Codex and VS Code were unpatched at publication; Claude Desktop's fix status is uncertain. EmbedCheck audits your own workstation: a status table with a source and date on every row, update checklists, a workspace-trust guide, a canary self-test that never reads a real secret, plus policy and report templates.
Payment Required
Launch Team
Render: Get up to $100K in startup creditsThe fastest way to deploy and scale apps and agents
Promoted
I built EmbedCheck the morning the EMBRACE research landed (Oct 29, 2026) because the finding is easy to miss: the preview inside your editor is not your browser, and two of the five tools were still unpatched at publication.
The kit is deliberately narrow. It audits one boundary, on your own machine: can the embedded preview reach outside the project folder, and are you running a fixed version? The canary self-test creates its own canary file in a temp directory — it never reads SSH keys,.env files, or tokens, and it makes no network calls. The researchers' demonstration of reading real secrets is described, never reproduced.
One honesty note, carried everywhere in the kit: Claude Desktop's status is uncertain. Forever no longer counts it among open flaws but published no fix version or date, so the kit never calls it patched or unpatched — it tells you how to verify. Patch statuses are as of Oct 29, 2026; re-verify before acting, and no CVEs were listed for any of the five issues.
Happy to answer questions about the boundary, the canary test, or what "verify your version" actually means for each tool. — Haku