browser-pilot — agentic threat model
The browser-pilot agent presents a high-risk profile due to its capability to drive a real browser via CDP, exposing the host system to indirect prompt injection, SSRF, and local data exfiltration if not strictly sandboxed.
OWASP AIVSS score rationale
| Autonomy of Action | 0.70 | |
| Goal-Driven Planning | 0.60 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.80 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.50 | |
| Dynamic Identity | 0.40 | |
| Multi-Agent Interactions | 0.20 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.50 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — relies on Claude models via Claude Code; susceptible to prompt injection leading to unauthorized browser actions.
Handles untrusted external web data (scraping, crawling, screenshots) which can introduce malicious payloads, indirect prompt injection, or sensitive data exposure during capture.
Orchestrated via Claude Code. High risk of tool misuse (CDP automation) where malicious inputs can force the browser to navigate to malicious sites, exfiltrate data, or perform CSRF attacks.
Not certain from the listing — likely runs locally on the user's machine where Claude Code is executed. If unsandboxed, CDP control of a local browser poses severe host compromise and local network access risks.
Not certain from the listing — no built-in evaluation, guardrails, or observability features are mentioned for monitoring browser actions or detecting malicious navigation.
Not certain from the listing — lacks explicit authentication, authorization, or compliance controls. Relies entirely on the host environment's security posture.
Acts as a tool/plugin within the Claude Code ecosystem. Vulnerable to cascading failures if Claude Code is compromised or if other plugins interact maliciously with the browser session.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).