page-agent

Least-privilege permissions

• Run the agent with a dedicated, low-privilege OS user account; restrict file system access to task-specific directories only.
• Use browser profiles with minimal permissions; disable extensions, camera, microphone, and location access unless explicitly required.
• Scope agent instructions to specific URLs and UI elements; prohibit navigation to unintended domains via explicit allow-lists in configuration.
• Implement role-based access control (RBAC) for sensitive operations; require explicit approval for form submissions, data deletion, or credential entry.

Network isolation

• Deploy the agent in a sandboxed container or VM with egress filtering; block outbound traffic except to whitelisted domains.
• Disable direct clipboard access and screenshot export to untrusted storage; route all outputs through secure, monitored channels.
• Use a proxy or VPN with request inspection to log and block suspicious page-interaction patterns (e.g., repeated failed logins, mass form submissions).
• Isolate the browser session from shared corporate networks; use a dedicated, air-gapped machine or containerized environment for high-risk tasks.

Monitoring

• Log all agent actions (navigation, form fills, clicks) with timestamps and input sanitization; exclude raw prompt text and session tokens from logs.
• Alert on anomalies: unexpected redirects, large data exfiltration, repeated authentication failures, or deviations from expected page interactions.
• Regularly audit browser session state (cookies, localStorage, sessionStorage) for unexpected data; clear sensitive cache after each task.
• Implement rate-limiting and throttling on agent API calls; flag rapid, repetitive actions that may indicate injection or runaway automation.

Red flags to watch for

• Natural language prompts containing credentials, API keys, or session identifiers; sanitize or reject inputs that match secret patterns.
• Agent attempting to navigate to unexpected domains, extract full page source, or interact with elements outside the declared scope.
• Browser state persisting across unrelated tasks; signs of session hijacking or unauthorized cookie exfiltration in logs or network traffic.
• Unmaintained or infrequently updated npm package; missing security advisories or community vulnerability reports; use a Software Composition Analysis (SCA) tool.