Browser agent security: what to allow, what to approve, what to never automate
A signed-in browser is powerful and web pages can carry hostile instructions. How to scope a browser agent, where to require approval, and how prompt injection is contained.
Browser agent security rests on keeping permission outside the model: a fixed set of actions, the narrowest tab scope that completes the job, human approval before consequential writes, secrets excluded from what the agent can read, and an always-available stop. Prompt injection is contained by treating page content as data, never as instructions that can widen scope.
Why a browser agent needs more care than an API integration
An API key has a scope written down. A signed-in browser session usually does not: it can reach everything that account can reach. A browser agent therefore starts from a wider blast radius than most integrations, and the controls have to narrow it deliberately.
Web pages add a second risk an API does not have. Page content is untrusted input, and text on a page can attempt to instruct the model. That is prompt injection, and the defence is architectural rather than a filter.
- A session can act on everything the account owns
- Page text is attacker-controlled on any site accepting user content
- Consequences are real: publishing, paying, deleting, emailing
Controls that actually contain it
The permission must live outside the model. In Melaya the agent chooses only from a fixed set of browser actions the extension implements; it cannot download scripts, execute generated JavaScript, or reach a shell. Tab scope is a visible user control, and the model cannot widen it. Consequential actions pause for approval, and stop is always one click away.
Password field values are omitted from everything the agent sees, and the guidance is explicit: never ask it to type passwords, one-time codes, or card numbers.
- Fixed action set, no arbitrary code execution
- Tab scope set by the user, not by the model
- Approval before publishing, paying, deleting or sending
- Secrets excluded from page reads
- Stop and disconnect available at any moment
What to never automate unattended
Some actions should always have a person in the loop regardless of how good the agent is: payments and financial transfers, anything that publishes publicly under your name, destructive operations, changes to permissions or credentials, and any communication a recipient will treat as coming from you.
Frequently asked questions
What is prompt injection in a browser agent?
Text on a page that tries to instruct the model, for example a hidden comment telling it to send data elsewhere. It is contained by treating page content as data and keeping permission outside the model, so a page cannot widen scope or skip approvals.
Can the agent see my passwords?
Password field values are omitted from page reads. Do not ask it to type passwords, one-time codes or card numbers.
Can it act on tabs I did not choose?
Not unless you widen the scope. It starts on the single tab you attach, and All tabs is an explicit user setting.
