Problem. ConnectSessionBrowser, PollSessionBrowser, ResolveSessionBrowser and DisconnectSessionBrowser are authorized at "chat" level, which includes public chatters. A chatter can connect first and hold the slot (denial of service), receive the owner's commands including typed text, and send back forged page content. Once the owner is connected, any chatter can message the session and drive the owner's browser. Trigger and delegated runs also get the browser.

Fix. Only the agent owner can connect. Commands run only for interactive runs started by the connected account. Trigger, delegated, and background runs never get the browser.

Branch: feat/integrated-browser