To let an AI agent work in your browser safely, hand it one tab in a separate profile, keep approvals on for anything that submits, signs in, downloads or pays, limit it to sites you trust, and keep a record of every step. Treat every page as untrusted, since hidden text can steer the agent.
Safeguard is an alternative you can switch to without losing what you already pay for. With the Safeguard Chrome extension, Search works in a browser tab you hand it, asks before risky steps and keeps every step on record. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.
What changes when an agent drives your browser
A chat assistant gives you text, and you decide what to do with it. A browser agent clicks, types and submits on your behalf, inside sessions where you are already signed in. That shift moves the risk from "bad advice" to "real actions".
Three things make browser work different from coding work in a terminal.
Every page is input. OWASP's entry on prompt injection separates direct injection, where the user's own prompt changes the model's behaviour, from indirect injection, where content from websites or files does it. A browser agent reads web pages all day, so it meets indirect injection by design. Anthropic's research post on browser agents says "No browser agent is immune to prompt injection" and calls the problem "far from a solved problem."
The agent sees what you see. Anthropic's safety guidance for Claude in Chrome says the agent "can't filter sensitive content out of what it sees," because whatever is visible in its tabs is captured. Open banking, HR or customer records in the same window and they become part of the conversation.
Actions are hard to undo. A sent message, a submitted form or a changed setting does not come back with an undo key. OWASP's entry on excessive agency lists three root causes: too much functionality, too many permissions and too much autonomy. Its mitigations include least privilege, user approval for high-impact actions such as sending or deleting, and logging so you can spot problems early.
What to allow, what to approve and what to keep
Sort browser actions into three groups and decide each one in advance. This table is a starting policy. Tighten it for regulated data.
| Action | Suggested setting | Why |
|---|---|---|
| Read a page, search, scroll, open a link on a trusted site | Allow | Low impact, easy to review afterwards |
| Fill a search box or filter, sort a table | Allow on trusted sites | Changes nothing outside the page |
| Submit a form, post a comment, send a message | Approve each time | Visible to other people and hard to reverse |
| Sign in, grant an OAuth permission, accept terms | Approve each time, or do it yourself | Creates access that outlives the task |
| Download a file | Approve each time | Brings untrusted content onto your machine |
| Change account, security or permission settings | Do it yourself | Changes who can do what later |
| Payments, purchases, trades, deleting data for good | Do it yourself | Real money or permanent loss |
| Type passwords, card numbers or ID numbers into a chat | Never | Use the product's secure sign-in flow, or do it yourself |
Two more rules belong next to the table.
- Scope the sites. Decide which sites the agent may use for the task and block the rest. Several tools below support allowlists or blocklists. Playwright MCP's README is clear that its origin allowlist "is not a security boundary," so use it as a guard rail, not your only control.
- Scope the session. Use a separate browser profile or an isolated session with no access to sensitive accounts. Anthropic's guidance recommends exactly this for Claude in Chrome, and both Playwright MCP and OpenAI's cloud browser keep their own sessions apart from your personal browser.
How five browser agents handle approvals
This is a facts-only comparison from each vendor's or project's own pages, read on 21 October 2026. It is not a ranking. Where a page we read did not cover something, we say so; that is not proof the feature is missing.
| Tool | Where the browser runs | Licence or source | Approval settings | Site controls | Record of actions |
|---|---|---|---|---|---|
| Claude in Chrome (Anthropic) | Your Chrome, through an extension | Commercial product | Manually approve, Automatically approve, Skip all approvals | Per-site permissions; admin allowlists and blocklists on Team and Enterprise | Permission history in extension settings; side panel sessions saved to history |
| ChatGPT cloud browser (OpenAI) | A separate computer in OpenAI's cloud | Commercial product | Confirmation in chat before consequential actions | Always ask, Auto approve or Always allow for website access, plus per-site allow or block | Progress shown in the conversation |
| Playwright MCP (Microsoft) | Your machine, launched by your MCP client | Apache 2.0 | Set by the MCP client you connect | --allowed-origins and --blocked-origins, described as not a security boundary | Not covered in the pages we read |
| Browser Use | Your machine or its hosted cloud | MIT | Not covered in the pages we read | allowed_domains on the browser | Not covered in the pages we read |
| Safeguard Search with the Chrome extension | A Chrome tab you hand it | Commercial product | Ask, Auto or Yolo; stops at risky steps with Allow once or Don't allow | Browser control must be enabled for the workspace | Every step kept on record |
Notes on each tool
Claude in Chrome. Anthropic describes it as an extension that lets Claude read, click and navigate websites alongside you, available on paid Pro, Max, Team and Enterprise plans and only in Google Chrome. Its permissions guide says that even with "Always allow actions on this site," Claude still asks before downloading files, entering potentially sensitive information or granting authorizations, and some actions, such as purchases, creating accounts and permanent deletions, are off limits in every mode. Before adopting it in a regulated team, note the safety page: where HIPAA is enabled the extension is off by default and is not covered under the Business Associate Agreement.
ChatGPT cloud browser. OpenAI's help center says cloud browser gives ChatGPT Work its own browser on a separate computer in the cloud, on paid plans other than Free and Go. It pauses for input, sign-in or confirmation, and asks in chat before actions that are hard to reverse or create a commitment, such as a booking or payment. Credentials go through a secure sign-in form that the model cannot see, and the browser keeps its own cookies rather than using yours. If your team used ChatGPT Atlas, OpenAI's help center now lists it as retired.
Playwright MCP. Microsoft's MCP server gives a model browser automation through Playwright, working from accessibility snapshots, and runs locally with npx @playwright/mcp@latest on Node 18 or newer. By default it keeps a persistent profile with your logged-in state, while --isolated keeps the profile in memory and discards it when the browser closes. The README says the server itself "is not a security boundary," so approvals depend on the client you run it under.
Browser Use. Browser Use is an MIT-licensed Python library (Python 3.11 or later) for browser agents, with a hosted cloud option. It works with OpenAI, Anthropic and Google models and local models through Ollama. Its sensitive data guide shows passwords replaced with placeholders the model sees, real values typed into the page afterwards, allowed_domains to restrict navigation, and vision turned off so screenshots do not leak secrets.
Safeguard Search with the Chrome extension. Search works in a browser tab you hand it, step by step. You set Ask, Auto or Yolo, it stops and asks before a risky step such as submitting a form, and every step is kept on record. Browser control must be enabled for the workspace.
Set up browser control with approvals in Safeguard
Here is the order we recommend, using the Safeguard Chrome extension as the example. The same thinking applies to any of the tools above.
- Decide the policy first. Write down which sites the agent may use and which actions need your approval, using the table earlier in this guide.
- Turn on browser control for the workspace. It must be enabled for the workspace before Search can work in a tab.
- Install the extension. The download page lists browser extension 1.0.4 on the Chrome Web Store for Chrome, Brave, Arc, Vivaldi, Opera and Edge, on Firefox Add-ons, and in Safari on iPhone and iPad inside the iOS app. Safari on Mac is in Apple review, so it is not available there yet. The demo below shows the Chrome extension.
- Use a clean profile. Open a Chrome profile that is not signed in to banking, payroll or personal email.
- Hand over one tab. Open the site the task needs and give Search that tab, not the whole window.
- Pick the mode. Start in Ask until you trust the task. Move to Auto for repeat work you have watched before. Keep Yolo for throwaway test sites.
- Answer the stops. When Search reaches a risky step such as submitting a form, it asks. Choose Allow once if the step is what you expected, or Don't allow if anything looks off.
- Review the record. Every step is kept on record. Read it after the task, and keep it if the work touches anything an auditor might ask about.
This demo walks through that flow: Search working in a tab you hand it, the Ask, Auto and Yolo setting, the stop before a form is submitted, and the record of each step.
Click through it at your own pace, or open it full screen.
What a good audit trail answers
Whatever tool you use, the record of a browser session should answer five questions: which tab or site the agent worked in, what it read, what it typed or clicked, which steps it stopped on, and what you approved or refused. If your tool's record cannot answer one of these, keep your own note for that task. Claude in Chrome keeps a permission history, ChatGPT shows progress in the conversation, and Safeguard keeps every step on record.
Worked example: a local agent on a staging site
If you build your own browser agent with Playwright MCP, you can apply the same limits in the launch command. This starts an isolated profile that is thrown away when the browser closes and only allows your staging origin:
npx @playwright/mcp@latest --isolated --allowed-origins "https://staging.example.com"
With Browser Use, keep secrets out of the model's view and pin the domains:
browser = Browser(allowed_domains=["https://staging.example.com"])
agent = Agent(
task="Log in with x_user and x_pass, then export the open tickets report",
llm=llm,
browser=browser,
sensitive_data={"x_user": "test-user", "x_pass": "from-your-secret-store"},
use_vision=False,
)
Both projects say their domain lists are guard rails. Pair them with a test account that holds no real data.
Do the work properly with the Safeguard CLI
Browser control covers web tasks. Much of the work around them happens on your own machine: reading files, fixing code and checking what changed. The Safeguard CLI is where that work happens with the same approval model. It scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It can write code, not only scan.
Install
macOS and Linux:
curl -fsSL https://cli.safeguard.sh/install | bash
Windows:
irm https://cli.safeguard.sh/install.ps1 | iex
It is a single static binary, so you do not need Node, Python or a JVM. It runs on macOS, Linux and Windows, on x86_64 or arm64 (Windows is x86_64 only). The download page lists CLI 1.4.0 with binaries for macOS Apple Silicon and Intel, Linux x86_64 and arm64, and Windows x86_64.
First session
- Open a terminal in your project and run
safeguardwith no arguments. - Type
/loginto sign in through the browser. - Type
/scan .to scan the current folder. - Ask in plain language, for example "how many critical vulns do we have".
- Type
@to attach a file from the folder you started in, and/resumeto pick up the last session in that folder.
Writing and fixing code
The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. Ask "fix the lodash CVE in this repo" and it edits the code with your approval. You can also use it as a general terminal assistant on your machine: find and read files, edit code and run commands, with your approval, plus everything security. The docs give "what's the latest file in ~/Downloads" as an example.
This demo attaches a computer running the Safeguard CLI and a folder, asks for a fix, then reviews the diff and approves the command before it runs. The demo notes that computer work from Search is available and expanding.
Click through it at your own pace, or open it full screen.
Use the Claude, ChatGPT or Codex plan you already pay for
Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Run /model to see or switch the model, and see the CLI docs for connecting one. If you would rather stay in the chat you already use, connect Claude or ChatGPT to the Safeguard MCP server and ask about your findings there.
Approvals
The browser rules carry over to the terminal. Tools that change things, such as writing a file, editing code or running a command, ask before they act. /permissions sets the mode:
- Ask prompts before every action.
- Auto approves known actions and asks for anything new. This is the default.
- Yolo approves everything.
Use Ask when you are fixing code another agent wrote, so you see every edit.
Scan what changed
After any agent session, in the browser or the terminal, check the dependencies before you merge:
safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:latest
safeguard scan --sbom sbom.cdx.json
safeguard validate sbom.cdx.json
Each scan builds an SBOM and matches it against vulnerability databases. Results land as JSON files under ./output, including vuln.json and license.json. safeguard validate checks CycloneDX, SPDX and VEX documents. When the local runner handles platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded. For a step by step version, read how to check what a coding agent changed.
CI with safeguard exec
For pipelines, run one non-interactive assistant turn:
safeguard exec "summarise the critical findings in this repository"
Pass or fail decisions belong to policies and gates, which are evaluated in the Safeguard platform, not by the CLI. The platform also offers reachability analysis, MCP Guardrail, and autonomous remediation with fix pull requests, which is off by default.
One platform on every surface
The download page lists the same platform everywhere, so you can start in the terminal, continue on the desktop and check findings on your phone. There is the CLI for the terminal and CI/CD; the desktop app 3.2.2 for Windows, macOS and Linux, where you ask your supply chain anything in plain English; mobile apps for iPhone and iPad on the App Store and Android on Google Play; IDE extensions for VS Code, JetBrains and Open VSX; and the browser extension. With nothing to install, there is the web interface, the Cloud CLI on Safeguard's infrastructure, a cloud browser, and a cloud sandbox tenant against a seeded demo repo, free for seven days with no card. For a wider tour, see the Safeguard CLI as an AI assistant on your machine.
Common mistakes
Handing over your everyday profile. If the agent's tabs share a profile with banking and email, those sessions are one click away. Use a separate profile or an isolated session.
Turning on "always allow" for a site you visit once. Site-wide permission is for sites you fully trust and use often. For a one-off task, approve single actions.
Treating an allowlist as the whole defence. Playwright MCP says its origin allowlist is not a security boundary, and the same caution applies to any list. Combine site limits with approvals and a test account.
Pasting secrets into the chat. OpenAI's cloud browser guidance says never to paste passwords, security codes or payment details into the conversation. Use a secure sign-in flow, a placeholder mechanism such as Browser Use's sensitive_data, or sign in yourself.
Skipping the record. If nobody reads the action history, you will not notice a step that went wrong until someone else does. Read it after every new kind of task.
Moving to the most permissive mode too early. Auto and Yolo modes save clicks. Earn them by watching the same task succeed in Ask mode first, and never use them on sites with real money or regulated data.
FAQ
Is it safe to let an AI agent control my browser?
It can be, with limits. Use a separate profile, allow only the sites the task needs, keep approvals on for submitting, signing in, downloading and paying, and read the record afterwards. Every vendor we read says prompt injection risk is reduced, not removed.
Which browser actions should always need my approval?
Submitting forms, sending messages, signing in, granting OAuth permissions, downloading files and changing settings. Keep payments, trades and permanent deletions for yourself. Claude in Chrome already blocks purchases and permanent deletions in every mode.
What is the difference between site permission and action approval?
Site permission decides where the agent may go. Action approval decides what it may do once it is there. OpenAI's cloud browser docs say allowing a site does not remove the need to review an important action, and Claude in Chrome still asks before downloads and sensitive entries on sites you always allow.
Can I switch to Safeguard and keep my Claude, ChatGPT or Codex?
Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.
Does Safeguard's browser control work in Firefox or Safari?
The browser extension is listed for Chrome Web Store browsers, Firefox and Safari on iPhone and iPad, with Safari on Mac in Apple review. The browser control demo shows the Chrome extension, and browser control must be enabled for the workspace.
What should a browser agent's audit trail include?
The site or tab, what the agent read, what it typed or clicked, where it stopped, and what you approved or refused. Safeguard keeps every step on record. If a tool's record misses one of these, keep your own note.
Can a website trick a browser agent?
Yes. Hidden instructions in a page, email or document are indirect prompt injection. Vendors train and filter against it, and Anthropic's own research says no browser agent is immune, so approvals and site limits matter.
Try it yourself
This demo sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.
Click through it at your own pace, or open it full screen.
Get the CLI, the desktop app or the browser extension from safeguard.sh/download, then read the CLI docs. To compare the coding agents you might pair with it, see AI coding agents compared.
Quick check
Why is an origin allowlist not enough on its own?
Tools such as Playwright MCP describe their allowlist as a guard rail rather than a security boundary. Pair it with action approvals, a separate profile and a test account.
What does Safeguard Search do when it reaches a risky step such as submitting a form?
It stops and asks. You choose Allow once or Don't allow, and every step is kept on record.
Sources
- Safeguard CLI documentation
- Safeguard CLI interactive terminal
- Safeguard download page
- Getting started with Claude in Chrome
- Claude in Chrome permissions guide
- Use Claude in Chrome safely
- Anthropic research on prompt injection defenses for browser agents
- Using cloud browser in ChatGPT
- ChatGPT Atlas retirement
- Playwright MCP repository
- Browser Use repository
- Browser Use sensitive data guide
- OWASP LLM01: Prompt Injection
- OWASP LLM06: Excessive Agency
Last reviewed: 21 October 2026.
