Four gates before letting an agent drive your logged-in Chrome, one still broken
Own-Equipment-5454 · reddit · 2026-09-26
The author of the open-source OnBridge tool shares the safety checklist he converged on before letting Claude Code or Cursor drive his signed-in Chrome:
- Input indistinguishable from human: synthetic dispatchEvent calls arrive with isTrusted false and get rejected, so all clicks and keystrokes go through the DevTools Protocol Input domain; the cost is a permanent Chrome debugging bar, which he treats as the one visible thing the agent can't hide.
- An approval layer the agent can't reach: actions are classed read/navigate/write/sensitive/destructive (buy, pay, delete, send, etc.); sensitive and destructive ones prompt the user, no MCP tool can change the mode, 25 seconds of silence counts as denial, and navigation between prompt and approval voids it.
- Page text marked as data: page-influenced content is wrapped in tags with per-result random ids, forged closing tags are defanged, tested against 28 planted prompt-injection payloads.
- A non-open-port channel: localhost-only binding, Origin pinned to the extension id, ECDH P-256 into HKDF into AES-256-GCM with fresh keypairs per connection.
He admits the remaining gap: approvals are by action class only, so getcookies can return raw values unprompted in no-prompt mode — a README overstatement he plans to fix.
More from coding & agent
- Dev uses open-source Ling-3.0-flash-VL to let AI redesign the foldable iPhone in a single HTML file — alifcoder · 2026-09-26
- TypeSafe's decision model Jev claims 200x speed, 400x cost savings on agent routing — adnan_hashmi · 2026-09-26
- Anthropic launches Claude plugin directory portal as MCP usage jumps 110x this year — ClaudeDevs · 2026-09-26
- Open-source Jev agent plays Pokemon Red live, pushing fast-decision AI beyond Tetris — supportingthedogs · 2026-09-26
- Anthropic deep dive: effort tuning in Claude Code pays off most for security and code review — trq212 · 2026-09-26
- After his Higgsfield subscription lapsed, he built a local video-gen setup with Codex — Automatic-Building84 · 2026-09-26