Browser & Computer-Use Agent Security

Best time to learn: After MCP, tool authorization, scoped identity, and human approval are implemented in Project 3. Do not start with a powerful computer-use agent before the simpler tool model is secure.

Prerequisites - Agent state machine and tool execution. - Authentication and delegated authorization. - Prompt injection and untrusted tool/page content. - Process/container isolation and network restrictions. - Human-in-the-loop approval.

### Threat model

A browser or computer-use agent can interact with untrusted websites and potentially sensitive user sessions. The webpage is an untrusted source of instructions. The agent's ability to click, type, download, upload, or execute commands creates real-world side effects.

Study: - Browser prompt injection and malicious webpage content. - Browser profile and session isolation. - Cross-origin navigation and account-boundary risks. - Credential and cookie protection. - Download and attachment handling. - Filesystem sandboxing and path restrictions. - Shell/command execution policy. - Network egress allowlists and DNS/IP restrictions. - Screenshot, clipboard, and page-content leakage. - Human approval for high-impact actions. - Time-of-check/time-of-use and approval-context binding. - Cancellation, emergency stop, and action audit trails.

### Labs

• Threat model (1h): Draw trust boundaries for agent, browser, website, identity provider, user session, filesystem, network, and model.

• Browser isolation (2h): Use a disposable browser profile and test that credentials/cookies are not shared with unrelated sessions.

• Prompt injection (2h): Create a local test webpage with benign instructions attempting to redirect the agent's task. Verify the agent treats page content as untrusted and cannot change its authorization scope.

• Filesystem and download sandbox (2h): Restrict downloads and file writes to a temporary workspace; test path traversal and unexpected file types.

• Network and command restrictions (1h): Deny unapproved destinations and shell operations. Verify the policy is enforced outside the model.

• Approval and emergency stop (2h): Require explicit approval for a sensitive action; bind approval to the exact action and parameters. Test cancellation during execution and audit the outcome.

### Project integration

• Project 3: Add a restricted browser or computer-use tool only after the normal agent's tool authorization works.

• Execution worker: Run in a disposable container or isolated environment with no host credentials, restricted mounts, and network egress controls.

• Approval layer: The user approves a specific action, not a vague plan that the agent can later reinterpret.

### Measurable completion criteria

• A malicious webpage cannot expand the agent's permissions.

• Browser sessions are isolated and disposable.

• Downloads and file writes are confined to an approved workspace.

• Network and command restrictions are enforced outside the model.

• Sensitive actions require parameter-bound approval.

• Cancellation and audit records work during partial execution.

Do not overreach: Do not give the agent unrestricted desktop access, host filesystem access, personal browser cookies, or a general-purpose shell.

------------------------------------------------------------------------