EMBRACE: Can AI Browser Previews Read Your Private Files?
EMBRACE researchers report file-read and other flaws in five AI tools. Compare affected boundaries, disputed trust assumptions, reported fixes and practical checks.
Researchers say yes: some AI assistants' embedded browser previews could read files outside the intended project. Forever Security's October 29 EMBRACE disclosure covers five tools, but not one universal exploit. Its practical warning is about desktop permissions—not proof that every AI chat, browser, version, or operating system is affected. Fix status and the vendors' disputed trust boundaries matter.
By OpenVeil Editorial. Research cutoff and last reviewed: October 30, 2026.
Who This Is For
This guide is for people who open downloaded projects, HTML reports or web previews inside AI development tools. It is also for privacy-conscious users deciding whether a task needs a desktop agent with machine access or a hosted conversational workspace.
The decision is not simply whether the model is trustworthy. It is whether the surrounding application gives an unfamiliar page more authority than the task requires.
What Is Confirmed
Forever Security's main report describes three different outcomes across five products. These are the researchers' findings and reported remediation dates, not our independent reproduction:
| Product | Reported outcome | Status described by the researchers |
|---|---|---|
| Cursor | Page-to-agent command execution chain | Patched October 1 |
| GitHub Copilot | Preview address-bar spoofing | Observed in 1.1.27; fixed in 1.1.29 on October 13 |
| Codex | Local preview reading outside its project | Unresolved at October 29 disclosure |
| VS Code | Local preview reading outside its project | Unresolved at October 29 disclosure |
| Claude Desktop | Local preview reading outside its project | Conflicting initial report handling; a completed fix is not established here |
The technical companion says the local-file demonstrations began with a file:// page. For Claude Desktop and VS Code, background workers bypassed checks applied to the top-level page. Codex reportedly lacked that initial file-read restriction. The Cursor demonstration involved an execution approval and model-dependent behavior; it was not universal, automatic execution merely from visiting any website.
The Workspace Trust dispute is important
The researchers say Microsoft declined the VS Code report because Workspace Trust gates the boundary. They describe an initial Anthropic rejection and a later acceptance through another submission. These are attributed accounts of report handling—not a finding that every vendor agrees on exploitability.
Microsoft's Workspace Trust documentation explains that unfamiliar folders can open in Restricted Mode, limiting features including agents, terminals, tasks and debugging. That is meaningful protection, not a detail to omit from a frightening headline. It is also not a promise that every extension or every preview context is safe.
What Is Still Unclear
The reviewed disclosure does not establish a complete affected-build and operating-system matrix, population-wide exposure or confirmed theft from ordinary users. Its directory-discovery demonstration uses macOS artifacts. Do not turn that into a claim that every Windows or Linux installation behaves identically.
The October 29 remediation snapshot is not proof that a specific installed build remains vulnerable today. We reviewed documents, not exploit payloads, and did not test these attacks on readers' devices.
Broader Help Net Security coverage demonstrates public attention. Repeated coverage of one disclosure is not multiple independent technical confirmations.
Why a Preview Is Not Necessarily a Normal Browser
The same-origin policy normally limits how scripts interact across origins. For ordinary web URLs, an origin depends on scheme, host and port—not whether two items look related in an editor. MDN also cautions that local-file origin handling can differ between implementations.
That distinction helps explain why a familiar browser-shaped interface is an insufficient security guarantee. An embedding application can add file access, agent communication or other native integration. The relevant question is what those integrations actually permit.
Think about three separate promises:
- Content privacy: Where does the conversation or uploaded material get processed and retained?
- Execution authority: Which programs or tools can act, with whose approval?
- Device reach: Which files, accounts and network destinations can the application access?
A favorable answer to one promise does not answer the other two. A no-training setting is not a filesystem permission. A local model is not automatically an isolated application. A private chat-history design is not endpoint protection.
Use Four Permission Receipts Before Opening a Project
Our original review framework is to ask for four independently checkable receipts. A receipt is evidence of a boundary, not a reassurance generated by the assistant itself.
| Receipt | Question to answer | Useful evidence |
|---|---|---|
| Input | What exactly will load? | The actual project, file type and navigation destination |
| Reach | What can the loading process read? | OS permissions, a documented isolation boundary and the trust state |
| Action | What can it request or execute? | Explicit tool permissions, approval rules and native integrations |
| Identity | What proves the destination is genuine? | An independently opened destination and trusted browser controls |
These receipts avoid a common category error: treating a credible-looking report as permission to trust the program rendering it.
For example, suppose someone sends a repository containing a financial dashboard. The dashboard might be legitimate, malicious or simply unfamiliar. Before previewing it, determine which environment will open it, whether that environment contains unrelated credentials, and whether the preview needs broader access at all. The assistant's recommendation to open a link is not a security review of that link.
If the receipts cannot be obtained, change the workflow. Ask for plain text, use synthetic data, review the project in a restricted environment, or have a qualified administrator assess it. Do not resolve uncertainty by disabling a control that blocks the task.
What To Check Before Your Next Preview
- Record the exact application and build. Similar product names can refer to different desktop, editor, web and extension components. Check the relevant vendor's current release information; a model-name change is not evidence of a browser fix.
- Review trust before opening unfamiliar work. In VS Code, inspect Workspace Trust and remain in Restricted Mode while assessing unknown folders. Avoid trusting a broad parent directory just to make a preview convenient.
- Separate review from valuable credentials. An assessment environment should not casually inherit personal browser sessions, private repositories or production secrets. A separate folder alone does not establish process isolation.
- Verify a login destination independently. When a preview asks for credentials, navigate to the intended service through a trusted route rather than relying solely on the embedded preview's displayed address.
- Escalate suspected exposure appropriately. Stop interacting with suspicious content and involve your security team. If credentials may have been copied, use the relevant provider's revocation and session-management controls. Deleting the HTML file would not revoke an already-copied secret.
This is a review checklist, not an exploit detector or a guarantee of safety. Do not run a public proof of concept on a real workstation to find out whether it contains sensitive files.
Where OpenVeil Fits—and Where It Does Not
Some tasks need a coding agent that can inspect a repository and operate development tools. Other tasks only need help drafting, explaining or comparing information. Match the authority to the job rather than installing the broadest tool by default.
OpenVeil offers adults a hosted AI workspace with browser-local normal chat history and no normal server-side chat-history record. Its documented capabilities include chat, search, uploads, voice, images, video and custom personas. It does not use documented prompts or uploads to train foundation models; active requests still require processing by OpenVeil and necessary providers.
OpenVeil is not an EMBRACE patch, desktop-agent sandbox, credential scanner or protection against unrelated browser and device vulnerabilities. Uploading a file to a hosted workspace also creates a processing boundary; it does not make that file stay entirely on your computer.
For a narrower conversational task, compare the private AI chat versus local AI tradeoff, understand browser-local chat history, and use the AI privacy-claim checklist. Read OpenVeil's privacy policy before deciding whether to try OpenVeil.
Frequently Asked Questions
Is this the same as a malicious AGENTS.md file?
No. The earlier Downloads instruction-file story concerns untrusted text gaining instruction authority. EMBRACE concerns embedded-browser integrations. Both warrant boundary reviews, but removing an instruction file would not establish that a preview process has appropriately limited permissions.
Does keeping chats locally protect all files on my laptop?
No. Browser-local history describes where a conversation record lives. It does not define every installed application's file permissions, secure the operating system or prevent someone with sufficient device access from reading local data. Treat history storage and endpoint access as separate questions.
Is opening the same file elsewhere guaranteed safe?
No. Different applications apply different rules, and active documents can carry other risks. The goal is not to replace one unverified preview with another. Establish the content's trust level and the chosen environment's actual authority first.
Should I disable every AI feature?
A blanket rule is not a substitute for a documented threat model. Use the minimum capabilities needed, keep software updated and respect organizational restrictions. If the task cannot be completed without unexplained access or weakened controls, stop and seek an approved alternative.
Bottom Line
The useful EMBRACE question is not whether an AI assistant looks like a browser. It is whether a page, a preview and an agent remain inside independently enforced permission boundaries. Verify the receipts before granting trust—and do not confuse conversation privacy with control over the rest of a computer.