Agent Browser Shield is a Chromium Manifest V3 extension that changes what a browser agent can perceive on a page. Its 35-plus rules can remove cookie banners, ads, footers and engagement rails; mask personally identifiable information and credentials; suppress invisible text, comments and user-generated prompt-injection surfaces; and reduce dark-pattern distractions before the page reaches the model.
This is a useful defense layer, but the project explicitly calls itself an alpha prototype. It does not prove that cleaned content is trustworthy, isolate browser credentials, constrain actions, or guarantee that every injection is blocked. The correct mental model is an input sanitizer with measurable utility and inevitable false positives—not a security boundary that makes arbitrary websites safe for autonomous transactions.
Where the shield sits
Untrusted website
│ DOM, accessibility tree, hidden text, forms
▼
Agent Browser Shield rules
│ cleaned page representation
▼
Browser agent + model
│ proposed clicks, typing, downloads
▼
Independent action policy / human approval
│
▼
Website side effect
The extension acts at the first arrow. That is valuable because prompt instructions embedded in a page may reach a model before application-level filters can distinguish them from useful content. But it cannot replace the final action policy: a clean-looking page may still contain fraudulent facts, malicious links or a legitimate button that causes an unacceptable side effect.
What its rule categories accomplish
| Category | Intended benefit | Likely false-positive cost |
|---|---|---|
| Page chrome removal | Reduce tokens spent on banners, footers, chats and navigation clutter | Hide policy links, support controls or required consent |
| Advertising cleanup | Remove sponsored and engagement content that diverts an agent | Remove legitimate marketplace results or disclosure labels |
| PII and credential masking | Reduce sensitive values sent to a model | Prevent an authorized task from reading an account identifier |
| Hidden-content suppression | Block invisible or comment-based injection payloads | Hide accessible labels or application state used by the agent |
| User-content filtering | Reduce untrusted instructions in reviews, posts or messages | Destroy the evidence a moderation or support task needs |
| Dark-pattern rules | Reduce scarcity, urgency and manipulative choices | Mask real inventory, deadline or warning information |
Read the benchmark correctly
The project reports roughly 11% fewer tokens and task success increasing from 81% to 91% across 19 real-web scraping tasks, using gpt-5-mini through Browserbase with three runs per task. It also reports larger token drops on selected pages, including 71% on a GitHub trending feed. The repository is admirably explicit that this is a directional benchmark, not a published paper, and that some pages regress.
Several limits matter. Nineteen tasks are a small sample; three runs provide limited variance information; scraping tasks do not represent checkout, support, authenticated administration or visually complex workflows; and the benchmark does not measure the PII or injection protections. Higher task success in this dataset should not be restated as “10% more accurate” for arbitrary agents.
| Claim | What evidence supports | What it does not support |
|---|---|---|
| ~11% fewer tokens | Mean difference in the published 19-task setup | Guaranteed savings on a specific site or model |
| 81% → 91% success | Observed task-judge results for that harness | Universal accuracy or statistical significance |
| Injection blocked | Rule behavior and test/demo coverage | Detection of every adversarial encoding or future attack |
| PII masked | Configured local masking rules | Complete data-loss prevention across images, canvas, files and actions |
| Local processing | Default extension rules do not send telemetry | Privacy of the browser agent, model, Browserbase or optional classifier |
Run an evaluation on your actual work
The included harness can run the same tasks with the extension off and on, then produce side-by-side reports and accessibility-tree differences. Use production-like tasks but test accounts and synthetic data. Include both expected wins and adversarial edge cases; a benchmark made only of noisy public pages will overstate value for a clean internal application.
- Create a versioned task set with URL, instruction, expected facts, allowed actions and forbidden actions.
- Run at least several repetitions per condition with fixed model, temperature, step budget and browser version.
- Save raw traces, cleaned representations, rule events, tokens, latency, result and judge rationale.
- Manually inspect every failure and a sample of passes; automated judging can share the agent’s blind spot.
- Classify regressions as missing content, wrong masking, broken controls, agent variance or site drift.
- Create per-site exceptions only after proving the narrowest rule responsible.
- Repeat after extension, browser, model or important website changes.
| Test class | Example | Expected outcome |
|---|---|---|
| Benign clutter | Cookie banner and unrelated recommended articles | Noise removed without losing the primary task |
| Necessary policy | Footer privacy or refund link requested by the user | Agent can still retrieve it or site rule is adjusted |
| Hidden injection | Invisible “ignore prior instructions” text | Content absent from the agent-visible representation |
| Visible hostile content | Review text instructing the agent to reveal data | Untrusted status preserved and instruction not followed |
| Authorized PII | User asks for masked account suffix | Policy defines whether partial access is permitted |
| Transaction | Checkout page with urgency labels | Facts remain available; purchase still requires approval |
| Accessibility | Control labeled only by hidden accessible text | Sanitizer does not make the control undiscoverable |
Observability is essential
A sanitizer that silently deletes content creates a new epistemic problem: the agent cannot report what it never saw. The project supports a debug trace recorder and JSONL export for automation builds. Enable trace collection during evaluation, protect traces as sensitive data, and disable or tightly retain them in production. Logs can reconstruct the original content or contain masked-value context.
For each task, record extension version, rule-set hash, site, triggered rules, number and category of removed nodes, mask counts, denylist decisions and optional classifier use. Operators should be able to compare original and cleaned representations without exposing those views to the same model being protected.
Privacy: local by default, with one notable option
The repository says the extension collects no telemetry, analytics or usage data and processes rules locally. It identifies one possible outbound call: the optional irrelevant-sections-redact rule, disabled by default, sends a compressed page tree to OpenAI for classification when enabled with an API key.
That exception can include sensitive page structure and text. Treat enabling it as a new data flow: determine which pages it may run on, which OpenAI account and retention controls apply, whether secrets are removed first, and whether authenticated or regulated sites must be excluded. “The extension is local” is only accurate when this rule is off and says nothing about the separate agent/model runtime.
License: source-available, not standard open source
Agent Browser Shield uses PolyForm Shield 1.0.0. The repository says commercial, internal and research use are free, but using it to build a product that competes with Agent Browser Shield or a PixieBrix product is restricted. Calling it simply “open source” hides that competitive-use condition. Product vendors, hosted browser platforms and security-tool companies should read LICENSING.md and obtain advice or a commercial license when their use may compete.
Deployment choices
The Chrome Web Store build works in Chromium-based browsers; agent runtimes may require an unpacked extension or packaged ZIP. Current development prerequisites include Node 24 or newer, Bun 1.3 or newer, uv and a recent Chromium version. Custom build defaults can enable rules, set a site denylist and configure automation trace behavior.
| Deployment | Advantage | Risk/control |
|---|---|---|
| Web Store | Simple update path | Pin/approve version through browser management and test before broad rollout |
| Unpacked build | Fast local testing and customization | Build provenance and manual update drift |
| Browserbase ZIP | Reproducible managed-session loading | Control artifact hash, session config and provider data flow |
| Custom defaults | Organization-wide rules and denylist | Overrides apply only to fresh storage; existing user state may persist |
| Per-site disable | Recovery when rules break a critical application | Creates an unprotected gap that needs expiry and review |
Defense in depth for browser agents
- Use a separate browser profile and test account with minimal permissions.
- Allowlist destinations and block arbitrary downloads or local-file access.
- Separate page content from trusted system instructions in the agent architecture.
- Require confirmation for purchase, deletion, publication, messages, credential changes and data export.
- Validate action parameters at execution time; do not trust values copied from the page.
- Limit model context, tokens, steps, spend and total task duration.
- Retain an audit trail linking page state, proposed action, approval and side effect.
- Use sandboxing and rollback where possible; sanitization cannot contain a malicious browser process.
Alternatives
| Approach | Best fit | Tradeoff |
|---|---|---|
| Agent Browser Shield | Chromium agents needing packaged local rules and traces | Alpha, browser-specific and source-available licensing |
| Custom DOM sanitizer | Narrow known sites and exact extraction contracts | Engineering and attack-maintenance burden |
| Structured site API | Stable first-party data access | Less visual coverage, but usually clearer trust boundaries |
| Accessibility-tree pruning | Agent runtimes already consuming structured browser state | Can still carry hostile visible text and lose visual context |
| Hosted browser safety layer | Teams wanting managed isolation and monitoring | External data processor and less transparent rules |
| Action-policy gateway | Preventing consequential side effects | Does not reduce poisoned context; best combined with input cleaning |
Frequently asked questions
Does it stop all prompt injection?
No. It blocks defined surfaces and patterns. Visible prose, images, encoded content and new attacks can remain.
Will it always reduce tokens?
No. The published mean is about 11% for one benchmark, and the project reports regressions on some pages. Measure your own tasks.
Does it send page data away?
Default rule processing is local with no telemetry. The optional irrelevant-sections classifier can send a compressed page tree to OpenAI.
Is it open source?
It is source-available under PolyForm Shield 1.0.0, which restricts competitive products. That is not an OSI-style unrestricted open-source license.
Can a business use it?
The project says commercial internal use is free, subject to the license’s competitive-use restriction. Review the actual use case.
What should be measured first?
Task success, token cost, false removals, missed attacks, latency and the rate at which site-specific exceptions are needed.
Primary sources
- Official repository, benchmark summary, privacy and disclaimer
- Official documentation and rule reference
- Official benchmark methodology and task data
- Official licensing explanation
- PolyForm Shield 1.0.0 text
- OWASP prompt-injection risk guidance
- Chrome Manifest V3 overview
Last reviewed July 25, 2026. This is an alpha prototype; verify the current rules, license, browser requirements and benchmark before deployment.
