Security

Understand what an agent can reach through ABG, what needs your approval, and what ABG records.

ABG is built for browser sessions that a person owns. The agent sees no tabs until you share one.

Consent boundaries

• Per-tab sharing is the default. You share a tab from the popup or with the share shortcut.
• A share ends when the tab closes, changes origin, or you revoke it.
• The optional all-tabs mode, Share all tabs (sandbox profiles only) in the popup, is for isolated profiles and sandbox machines. Do not turn it on in a personal or mixed-use profile. Turning it on asks Chrome for optional <all_urls> access. Turning it off revokes every all-tabs entry and removes that permission.
• Bookmarks and Reading List need their own popup toggles and optional browser permissions. They are browser-owned personal data, not shared-tab content.

Domain sharing

In isolated profiles or sandbox machines, select Matching domains under Tab sharing to share matching existing and new tabs automatically. Add multiple exact domains, wildcard subdomains such as *.example.test, or full-hostname regular expressions. Any matching condition is sufficient, subject to the shared HTTPS and port restrictions. Preview the matching tabs before applying. Leaving the allowed scope revokes automatic access. Rules are saved per connection, and editing them cancels Sandbox auto-resume consent. This mode requests the same optional <all_urls> permission as All tabs; use manual sharing in personal or mixed-use profiles.

Approvals

• Write commands such as click, fill, paste, navigate, upload, and dialog handling open a local approval window by default. The popup setting is Require approval for write operations.
• Read-only commands, raise, and revoke never prompt.
• General JavaScript eval is off by default. Turn it on with Allow approved JavaScript eval. While Trusted automation (AutoMode) is off, every eval call needs --approve and a local approval window that shows the exact script.
• Tab recording always needs approval, even when other approvals are off. It records only an already-shared tab, shows a REC badge while active, and writes WebM to a local file.

Audit log

The Gateway writes every operation to a local JSONL file at ~/Library/Logs/AgentBrowserGateway/audit.jsonl. To see recent entries:

abg audit --lines 50

For a daily or weekly summary built from the same log:

abg activity --period day

Entries record action names, tab references, selectors, approval mode, plugin command names, recording start and stop, and byte lengths where relevant. They do not record pasted text, plugin argument values, or recorded media. For bookmarks and reading-list, entries record ids, counts, and query byte lengths, but not full saved URLs.

Local transport

• The Gateway listens on 127.0.0.1. The normal local workflow needs no ABG account or cloud relay.
• The Gateway WebSocket accepts only browser-extension origins, so a normal website cannot connect to it from page JavaScript.
• The CLI reaches the Gateway through an owner-only Unix socket, or a loopback WebSocket that needs a per-launch token.
• If you pair a phone, ABG also opens a listener on the private Tailnet or LAN interface you choose. It runs only while a pairing offer or active grant exists. See Architecture.

Extension 1.3.6 also supports explicitly selected Cloud mode. Shared content and requested results pass through the selected service to authorized AI clients. Web login registers the browser; per-tab sharing remains the default. Cloud policy may require approval, and recording always prompts. Only isolated profiles should opt into Sandbox auto-resume. This mode uses the service’s authorization and audit rather than the desktop audit file. It does not add telemetry or silently enable JavaScript. See the Cloud guide.

What ABG defends against

• Prompt injection that tries to reach unshared tabs. The Gateway rejects operations on tabs that are not shared.
• Over-sharing through navigation. A manually shared tab is revoked when its origin changes.
• Silent agent activity. Every operation goes to the audit log.
• Silent recording. Recording cannot start from the CLI without your Allow click.

What ABG does not defend against

• a malicious local user or a root-level compromise
• malicious browser extensions in the same profile
• browser vulnerabilities
• operations you explicitly approve
• plugin code you choose to install

Plugins run in the local Gateway process. Install them only from sources you trust.

Safer automation defaults

Prefer named commands such as read, get, find, wait, snapshot, and plugin commands. Use eval only as a last resort. If you turn eval on, keep AutoMode off unless the profile is trusted and isolated enough for that workflow.

Report a vulnerability

Do not open a public GitHub issue for security vulnerabilities. See SECURITY.md for the current reporting status and threat model.

When operation approval is off, Cloud reads including snapshots, element descriptions, find results, editable validation, input values, state values, and network response bodies skip the approval window on shared tabs. This applies to manual shares as well as Sandbox, without requiring AutoMode or automatic resume. Cloud account-forced approval still applies, and password and sign-in-code reads remain blocked. Native file attachments also follow the operation approval toggle on both manual shares and Sandbox. Turning it off skips the attachment approval window for all file paths, without requiring AutoMode or automatic resume. Chrome’s file-URL permission is still required. Recording retains its separate approval gate.