B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Developer tools, Web & browsing
browser-harness
Let Claude Code, Codex or Cursor use your real Chrome, logged in as you. One prompt to set up. Open source, MIT.
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 47/100
- Rank
- #160 of 500
- GitHub stars
- 18.5k
What it does
browser-harness lets Claude, Codex, or Cursor control your real Chrome browser as if you were using it, with full access to your logged-in sessions and cookies. Set up with a single prompt to bridge your AI coding assistant with web automation capabilities.
Who it’s for
Developers and builders who want AI coding assistants to interact with web applications, test flows, or perform browser-based tasks using their authenticated sessions. Best suited for individuals and small teams with high trust in their development environment.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/browser-use/browser-harness (opens external site) for the latest setup. Typical setup likely involves:
npm install browser-harness
Then configure in Claude Desktop claude_desktop_config.json or your editor's MCP settings (exact format depends on current release—check repo for mcpServers JSON structure).
Risks
- Credential scope: Grants AI agents full access to all logged-in sessions, cookies, and authentication tokens in your Chrome instance—any prompt injection or agent misconfiguration could expose sensitive accounts.
- Browser hijacking: Malicious or misdirected prompts could autonomously navigate to phishing sites, exfiltrate data, or perform unintended transactions using your identity.
- Session theft: If the connector is compromised or logs are captured, attackers gain direct access to your browser state without needing passwords.
- Supply chain risk: As an open-source project with high GitHub stars but minimal npm adoption, long-term maintenance and security review are unclear; no formal security audit evident.
- Data exfiltration: AI agents can read and extract any content visible in your browser, including personal emails, financial data, or proprietary information.
How to stay secure
Least-privilege permissions
- Create a dedicated Chrome profile with zero pre-logged accounts; log in only to services the current task requires, then log out after completion.
- Use Chrome's guest mode or a separate browser instance for untrusted AI prompts; never connect browser-harness to your primary profile.
- Disable browser extensions in the dedicated profile (especially password managers, payment tools, and SSO helpers) to prevent agent-accessible credential leaks.
Network isolation
- Run browser-harness on an isolated network segment or VM with no access to internal corporate networks, NAS drives, or sensitive systems.
- Use a firewall rule to block outbound connections to known phishing/malware domains; whitelist only required sites if the task permits.
- Disable Chrome Sync and cloud services; keep the browser instance offline except for necessary tasks.
Monitoring
- Enable Chrome DevTools Protocol (CDP) logging at connection time; audit all navigations and API calls post-session.
- Set up a separate user account on your OS to run the agent; monitor process CPU, memory, and network I/O for anomalies in real time.
- Keep detailed prompt logs and screenshot/timeline records; compare expected vs. actual browser behavior after each run.
Red flags to watch for
- Agent navigates to unrelated domains, clicks ads, or opens new tabs without your explicit instruction.
- Unexpected delays, high CPU spikes, or network traffic during idle moments.
- Prompts requesting "full access," "disable restrictions," or asking you to paste credentials—refuse and disconnect immediately.
- Session crashes or browser restart requests; they may indicate an attempt to clear audit logs.
Alternatives
- Playwright / Puppeteer with Claude: Use headless browser automation libraries directly in Claude Code without agent autonomy over your real browser.
- Browserless.io or similar cloud services: Rent isolated browser instances rather than exposing your logged-in Chrome.
- Selenium Grid: Manage browser automation in isolated containers with explicit credential injection and lifecycle control.
- Lantern or Claude Web Browsing: Let Claude browse the web read-only without controlling your local authenticated session.