Sandboxing Browser AI Agents

Posted4 months agoActive4 months ago

earlence

67 points

7 comments

earlence.comTechstory

skepticalmixed

Debate

60/100

AI SafetyBrowser SecuritySandboxing

Key topics

AI Safety

Browser Security

Sandboxing

The article discusses sandboxing browser AI agents to prevent potential security risks, and the discussion revolves around the effectiveness of current sandboxing methods and the need for more robust security measures.

Snapshot generated from the HN discussion

Discussion Activity

Light discussion

First comment

Peak period

84-90h

Avg / period

2.3

Key moments

01Story posted
Sep 11, 2025 at 5:48 PM EDT
4 months ago
Step 01
02First comment
Sep 15, 2025 at 9:32 AM EDT
4d after posting
Step 02
03Peak activity
5 comments in 84-90h
Hottest window of the conversation
Step 03
04Latest activity
Sep 15, 2025 at 9:20 PM EDT
4 months ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (7 comments)

Showing 7 comments

dangoodmanUT

4 months ago

1 reply

"lightweight sandboxing" isn't far enough for agents, you really need _full sandboxing_.

For example, can you instruct it to open file:// from the local os, or download some colossal 100TB file?

prompt injection isn't going away anytime soon, so we have to treat the agent like arbitrary code. Wrapping in something like Firecracker, and giving the agent extremely scoped access is crucial.

One achillies heel of browser use agents is that you often can't filter permissions like you can with API keys, which is shown in this demo by having the agent make an api key.

4 months ago

1 reply

Agreed on the sandboxing. I think it is a nut that the LLM providers are going to need to crack in order to allow companies to operate AI safely without keeping users in the loop. Otherwise automated workflow are going to need to be orchestrated elsewhere (and be more limited in what steps they lean on LLMs to solve) in order treat the LLM output as just data.

Where I landed was a bit of a Jupyter notebook concept for a conversation where a user/API can request that certain prompts (cells) be trusted (elevated permissions for tools and file system access) while you do the bulk of the analysis work in the untrusted prompts.

(if anyone is interested in the germ of the idea: https://zero2data.substack.com/p/trusted-prompts)

brianjking

4 months ago

Thanks for the link.

cjbarber

4 months ago

I hope that we get more solutions in this direction! I want to use ai browser agents and other things that involve connecting ai up to my accounts, but I've avoided so far and will continue to avoid until I'm confident on the security.

cuntymaccunto

4 months ago

Surely this time it will work

ericdotlee

4 months ago

Just curious, but I'm curious what these platforms are chasing? I assume a quick acquisition by an org like Salesforce building huge agentic tooling?

behnamoh

4 months ago

How about we disable all browser AI features? That's what I do with Brave: I go to brave://flags and disable everything that mentions "AI" or "Leo".

I don't want a trojan horse in my own browser.

View full discussion on Hacker News

ID: 45216460Type: storyLast synced: 11/20/2025, 4:47:35 PM