co-browser/browser-use-mcp-server — agentic threat model

Not certain from the listing — The listing does not specify the underlying LLM used, but the model is highly vulnerable to indirect prompt injection and adversarial reprogramming when parsing arbitrary web content during autonomous browsing.

Not certain from the listing — No explicit RAG or vector database is mentioned, but the agent dynamically ingests and processes unstructured data from the live web, presenting a high risk of data poisoning and malicious payload delivery.

Uses the browser-use framework to orchestrate multi-step web tasks. The primary threat is tool misuse and insecure tool integration, where malicious web pages can hijack the browser-use planning loop to perform unauthorized actions.

Runs Chromium inside Docker with a VNC server and SSE transport. Key threats include container escape, unauthorized VNC access to view active sessions, and lateral movement within the host network if the container is compromised.

Provides a VNC server for visual observation of the browser, but lacks automated guardrails, real-time prompt injection detection, or structured audit logging of LLM-to-browser actions.

Not certain from the listing — There is no mention of authentication, authorization, or transport security (e.g., TLS) for the SSE endpoint or VNC server, posing compliance and access control risks.

Exposed as an MCP server, allowing other LLMs and agents to orchestrate it. This introduces risks of cascading failures and trust abuse if a parent agent is compromised and instructs this agent to perform malicious web actions.