mcp

Least-privilege permissions

• Use a separate browser profile dedicated only to the AI agent, not your personal or work account—this prevents the agent from accessing your stored passwords and login sessions.
• Disable autofill and password saving in the agent's browser profile so credentials aren't automatically available to extract.
• Restrict to specific websites only by configuring a whitelist (allowlist) of domains the agent can visit; block access to banking, email, and sensitive platforms.
• Remove browser extensions from the agent's profile—extensions can capture data or be manipulated by the agent to perform unwanted actions.

Network isolation

• Run the agent on an isolated network or virtual machine that has limited access to your internal company systems and databases.
• Block direct access to internal tools (VPNs, admin dashboards, financial systems) from the machine running the agent using firewall rules.
• Use an air-gapped test environment for testing new agent configurations before deploying to production or general use.

Monitoring

• Log all agent actions (websites visited, forms submitted, data accessed) and review logs daily for suspicious activity or unexpected behavior.
• Set up alerts for high-risk actions like form submissions, file downloads, or access to sensitive domains.
• Capture screenshots of agent sessions periodically to visually inspect what the agent is actually doing on websites.

Red flags to watch for

• Agent visits unexpected websites or domains you didn't explicitly allow or request.
• Unusual form submissions or clicks, especially on payment, authentication, or data entry pages you didn't ask the agent to interact with.
• Large data transfers or downloads from the agent's machine to external locations.
• Agent behavior changes suddenly without configuration updates—may indicate prompt injection or compromise of the agent's instructions.