The experimental desktop browser and agent browser tool on feat/integrated-browser had a security review on 2026-09-24. None of it merges until every task below is done on that branch.
Threat model
The agent server, the agent owner, other people who can chat in a session, and every website the user visits are untrusted. The user's signed-in browser session (cookies for mail, bank, admin panels) is the asset. Page content must never become permission.
Target design
Browser access is off by default. The user allows one agent session to use one website, with the agent name and server host shown. Moving to another website needs a new approval.
Only agents the user owns can ask. Public or shared agents never get the browser.
The agent server binds a connection to the agent owner and runs browser commands only for interactive runs that owner started.
Browser output never reaches anyone except the owner.
Agent navigation to another website needs approval. Loopback and private networks are blocked. Password fields are off limits.
Tasks
Opt-in, per-website browser access (critical)
Agent server binds browser connections to the owner (critical)
Browser output stays private on shared and public agents (critical)
Prompt-injection guards for agent browser actions (high)
Block agent navigation to loopback and private networks (high)
Websites cannot switch the app to Seed routes without a user gesture (medium)
Assistant context does not leak secret-bearing URLs (medium)
Bounded favicon loading (medium)
Webview and session hardening (medium)
Do you like what you are reading? Subscribe to receive updates.
Unsubscribe anytime