If an AI agent runs inside the page and can see the DOM and the user’s session, how do you keep it safe without limiting what it can actually do?
PageAgent’s differentiator is that site developers can embed it directly into their own pages. In that scenario, with proper system instructions plus a built-in whitelist/blacklist API for interactive elements, the risk is pretty manageable.
For the general-agent case, operating on pages you don’t control, the risk is definitely higher. I’m currently working on the human-in-the-loop feature so the user can intervene before sensitive actions.
Would love to hear other approaches if anyone has ideas.
How are AI agents built into browsers sandboxed by comparison?
Recent work in sandboxing agents; https://news.ycombinator.com/item?id=47223974