Disposable Browser Profile Isolation

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R33 — Playwright isolated contexts & storage state

   R10 — OWASP Session Management

   R04 — OWASP LLM01 Indirect Injection

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Configure Playwright to launch ephemeral, zero-credential browser contexts per task. *Lab:* Prove cookies, localStorage, and auth tokens cannot leak across separate agent runs or from the host browser.

   Build a local test webpage containing visible and hidden DOM/CSS instructions attempting to hijack the agent's goal. *Lab:* Prove webpage content is treated strictly as untrusted data and cannot expand the agent's task scope or tool permissions.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 58 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Browser session-isolation test + malicious webpage injection regression test.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R04OWASP Top 10 for LLM Apps↗ genai.owasp.org

  Prompt injection, sensitive info disclosure, improper output handling, excessive agency, vector weaknesses, unbounded consumption.

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

• R33Playwright Documentation↗ playwright.dev

  Isolated BrowserContext, downloads, permissions, screenshots, bounding boxes, locators, and tracing.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsPlaywright · reference
  Isolation | Playwright

  Defines BrowserContext as a non-persistent, isolated session with its own cookies, localStorage and cache, which is the mechanism you configure to prove state cannot leak between agent runs or from the host browser.

  R33checked 2026-11-11
• docsOWASP Gen AI Security Project · reference
  OWASP Top 10 for LLM Applications 2025

  Frames prompt injection, sensitive information disclosure, improper output handling and excessive agency as separate failure classes, which is the checklist you use to show that webpage text cannot expand the agent's task scope or permissions.

  R04checked 2026-11-11
• videoMicrosoft Developer · 6 min
  Episode 4: Indirect Prompt Injection Explained | AI Red Teaming 101

  Explains the data-versus-instruction boundary and demonstrates indirect injection through consumed content, the exact failure you reproduce with a local test page containing visible and hidden DOM/CSS instructions.

  R04checked 2026-11-11
• videoByteMonk · 13 min
  AI Browsers Are Stealing Your Data (Prompt Injection Explained)

  Shows how agentic browsers carry live authenticated sessions, so a single injected instruction can exfiltrate cookies or act as the user, motivating disposable zero-credential profiles per task.

  R04R33checked 2026-11-11
• repoGoogle Research · runnable code + paper
  GitHub - google-research/camel-prompt-injection: Code for the paper "Defeating Prompt Injections by Design"

  Implements a capability-based control flow where untrusted page data never reaches a privileged planner, giving you a testable reference for proving page content cannot escalate tool permissions.

  R04R33checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.