Threat-model a browser/computer-use agent

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R33 — Playwright browser contexts & isolation

   R41 — OWASP Agentic webpage & computer-use threats

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Threat-model P3's browser/computer-use agent: LLM, Playwright browser context, untrusted DOM/webpage, identity provider, cookies, local filesystem, network egress, human operator, and D9 Pixel Auditor.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Mark every trust boundary and define Abuse Cases for invisible DOM overlays, clickjacking, cookie theft, and drive-by downloads.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Browser/computer-use agent STRIDE threat model and architecture diagram.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R33Playwright Documentation↗ playwright.dev

  Isolated BrowserContext, downloads, permissions, screenshots, bounding boxes, locators, and tracing.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Cheat Sheet Series · long-form reference
  AI Agent Security - OWASP Cheat Sheet Series

  Walks the agentic threat taxonomy (tool misuse, excessive agency, memory poisoning, inter-agent trust, human oversight) so you can label every trust boundary between the LLM, browser context, cookies, filesystem, egress and human operator in the P3 threat model.

  R41checked 2026-11-11
• docsPlaywright · reference
  Trace viewer | Playwright

  Explains how a trace records per-action DOM snapshots, screenshots and network calls with timestamps, which is exactly the evidence trail you need when reasoning about what an agent could see and click during a run.

  R33checked 2026-11-11
• videoIBM Technology · 10 min
  Securing AI Agents: How to Prevent Hidden Prompt Injection Attacks

  Shows how hidden page content reaches a browser agent through the DOM and why the model cannot distinguish data from instructions, the core attack edge you must draw when threat-modeling the browser/computer-use agent.

  R41checked 2026-11-11
• videoEmbrace The Red · 58 min
  Agentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents (39c3)

  Concrete exploitation walkthroughs against computer-use agents (persistent injection, tool abuse, session abuse) that map directly onto the assets in P3: browser context, identity provider, cookies, filesystem and egress.

  R41R33checked 2026-11-11
• articlePalo Alto Unit 42 · ~12 min read
  Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild

  Documents real web-delivered indirect prompt injection chains, giving you observed attacker behavior to justify threats and mitigations rather than hypothetical ones in the P3 threat model.

  R41checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.