Revisit browser/computer-use security

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R33 — Playwright security

   R41 — OWASP Agentic computer-use threats

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Revisit P3's browser/computer-use security boundary.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Execute a chained end-to-end attack combining a deceptive webpage DOM overlay, a drive-by download attempt, an unauthorized outbound network request, and a sensitive action requiring D9 Pixel Auditor verification and parameter-bound human approval. Prove every link in the defense chain holds.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   End-to-end browser attack-chain test transcript and D9/D11 audit trail.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R33Playwright Documentation↗ playwright.dev

  Isolated BrowserContext, downloads, permissions, screenshots, bounding boxes, locators, and tracing.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsMicrosoft · Full docs
  Playwright Documentation

  The assigned reading for BrowserContext isolation, downloads, permissions, screenshots, bounding boxes, locators, and tracing — every primitive the D9 pixel auditor relies on to attribute an action to a rendered element.

  R33checked 2026-11-11
• videoDonato Capitella · 13 min
  Prompt Injection in LLM Browser Agents

  A live mailbox-exfiltration demo against a browser agent, then a breakdown of the operational loop and where the injected instruction enters it, ending on limiting agency and detection.

  R41R33checked 2026-11-11
• videoTesting Funda by Zeeshan Asghar · Trace demo
  Playwright with Javascript tutorial #10 | Debugging with Playwright Trace Viewer

  Shows recording and replaying a trace with per-action DOM snapshots, which is how you reconstruct what a computer-use agent actually saw and clicked when auditing a suspicious step.

  R33checked 2026-11-11
• articleAnthropic · Research writeup
  Mitigating prompt injections in browser use

  Reports measured attack success with and without mitigations for browser agents and argues for defence in depth rather than a single classifier, which is the residual-risk statement your boundary review needs.

  R41checked 2026-11-11
• repoMeta Research (GitHub) · Benchmark harness + Docker env
  WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks

  A runnable end-to-end web environment with injectable attacker goals, so you can regression-test P3's browser boundary against new injection strategies instead of trusting a one-off manual test.

  R41checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.