Review what your AI assistant's browser can access

An AI assistant's embedded browser can expose more than the page you opened. In its 2026-10-29 EMBRACE report, Forever Security described flaws in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop. I would review that browser's access before opening an unfamiliar project's preview. ^[1]

Identify the browser integration you use

Record the assistant, its installed version and whether it opens pages inside the app. Forever Security's findings concern particular embedded-browser integrations. Naming an affected product does not establish that every version or browsing mode has the same flaw. ^[1] ^[2]

The technical report describes different outcomes: page content reaching Cursor's agent instructions, a spoofed address in GitHub Copilot, and local-file access in Codex, Claude Desktop and VS Code. These require different fixes. ^[2]

Check the disclosure date before deciding you are patched

Forever Security reported that Cursor had patched its finding on 2026-10-01 and GitHub Copilot had fixed the address spoof in build 1.1.29 on 2026-10-13. It described Codex and VS Code findings as open when it published on 2026-10-29. Those are the researcher's dated statements, not a current patch inventory. ^[1]

Compare your installed build with the vendor's current security notices and release notes. If you cannot find a notice covering the reported browser issue, do not infer that an unrelated update resolved it.

Review local previews as untrusted input

The technical analysis describes local HTML reading files beyond the intended project. In the Claude Desktop and VS Code cases, the researchers reported that restrictions applied to the page but missed background workers. A worker is a script the page starts separately. ^[2]

Before opening an unfamiliar repository's preview, inspect what it loads and which files the assistant can reach. I would use a separate disposable environment without personal credentials for untrusted examples. That limits what is exposed; it does not repair a browser vulnerability.

Inspect the action behind an approval

The Cursor finding used page-supplied text to influence the agent's instructions. GitHub Copilot's finding concerned what address the integration showed to the agent and user. A familiar-looking page or an assistant-generated link is insufficient evidence that the next action is safe. ^[2]

Read the actual command, destination and requested file access before approving an action. If an organization manages your machine, give its security team the installed version and the relevant finding so they can decide which browser features to restrict while checking the vendor's response.