browsermcp/mcp — agentic threat model

Not certain from the listing — The agent relies on external LLMs via the Model Context Protocol (MCP). The primary L1 threat is prompt injection or adversarial page content that hijacks the model's instructions to execute malicious browser actions (e.g., transferring funds or exfiltrating data).

The agent reads active page content and DOM structures to execute its tasks. The primary threat is data poisoning or indirect prompt injection from untrusted web pages, which can manipulate the agent's behavior or lead to the exfiltration of sensitive session data.

The agent framework exposes powerful browser control tools (click, type, navigate, read). Insecure tool integration or lack of strict input sanitization on these tools could allow an attacker to bypass intended boundaries and execute arbitrary actions in the browser.

The agent runs locally ('local-first, no cloud') as an MCP server paired with a Chrome extension. While this avoids cloud-hosting risks, it exposes the local host if the MCP port is unsecured, potentially allowing local privilege escalation or unauthorized local browser control.

Not certain from the listing — There is no mention of built-in logging, audit trails, or guardrails to monitor what the agent is clicking or typing, creating a significant blind spot for detecting unauthorized or malicious browser actions.

The agent reuses existing logins and cookies to act as the user, bypassing traditional authentication boundaries. There is a severe lack of explicit authorization controls or policy enforcement to restrict which domains the agent can interact with.

As an MCP server, this agent is designed to be called by other orchestrators or agents. This introduces a high risk of cascading failures or agent-to-agent trust abuse, where a compromised upstream agent exploits this tool to hijack the user's browser.