Sandboxed Browser Agents Assess
Overview
Sandboxed browser agents run Playwright or Chromium in isolated VMs or containers without access to corporate SSO profiles on engineer laptops (browser-use sandbox). The pattern is offered as managed infrastructure (Browserbase, Browser Use Cloud, Kernel cloud browsers used from E2B sandboxes) and is also how vendor agents such as ChatGPT agent operate, in a dedicated virtual machine rather than the user's browser (E2B remote browser, The Register).
Assess for internal automation with network egress controls. Agents that reuse personal browser sessions with saved passwords are outside the scope of this rating and should not be used for company work.
Adoption Signals
- Browserbase raised a $40M Series B in June 2025 led by Notable Capital and reported more than 50 million browser sessions in 2025 up to that point, more than 1,000 customer companies, and more than 20,000 developer sign-ups (Pulse 2.0).
- browser-use documents a
@sandboxdecorator that runs the agent in the cloud next to the browser and positions it as the way to run browser-use in production (browser-use sandbox). - E2B documents connecting its code sandboxes to Kernel cloud browsers over CDP, keeping the browser outside the sandbox that runs agent code (E2B remote browser).
- ChatGPT agent (July 2025) runs in its own virtual machine with a visual and a text browser, a terminal, and connectors (The Register).
- Vendors now publish injection metrics: Anthropic tested 123 cases across 29 attack scenarios for Claude in Chrome and reported attack success falling from 23.6% to 11.2% with mitigations (Claude for Chrome).
Risks
- Isolation limits reach, not hijacking. Brave showed hidden instructions on a web page making Perplexity's Comet exfiltrate a user's email address and one-time password (Brave), and OpenAI says prompt injection is "unlikely to ever be fully 'solved'" (TechCrunch). A sandbox bounds what a hijacked agent can touch; it does not prevent the hijack.
- Credentials re-enter through profiles. Cloud profiles that store cookies and authentication across runs (browser-use sandbox) put every logged-in account inside the blast radius.
- Data leaves the network. Gartner's December 2025 advice to block AI browsers cites active web content, history, and open tabs being sent to cloud AI back ends (The Register); hosted browser services raise the same question for page content and screenshots, so DPA and region need checking.
- Scraping and terms-of-service exposure. Country proxies offered "to bypass captchas, Cloudflare, geo-restrictions" (browser-use sandbox) can put automation in breach of target sites' terms.
- Wrong isolation layer. Playwright browser contexts isolate sessions from each other inside one browser (Playwright) and the Chromium sandbox protects the OS from compromised renderers (Chromium sandbox); neither stops an agent from misusing a legitimate session, which is why the VM or container boundary and egress rules matter.
Pros & Cons
Advantages
- Running the browser in a disposable VM or container keeps the agent away from an engineer's SSO sessions, saved passwords, and local files, in line with Brave's call to isolate agentic capabilities from regular browsing after it demonstrated prompt-injection account takeover in an AI browser.
- Managed infrastructure is mature enough to pilot: by June 2025 Browserbase reported more than 50 million browser sessions that year and more than 1,000 customer companies, and browser-use ships a sandbox decorator that runs the agent next to a cloud browser.
- The largest vendors use the same pattern: ChatGPT agent works in its own virtual machine with visual and text browsers instead of driving the user's own browser.
Disadvantages
- Isolation does not stop prompt injection: OpenAI states it is unlikely ever to be fully solved, and Anthropic's own red-teaming still measured an 11.2% attack success rate for browser use after mitigations.
- Persistence features such as saved cloud profiles with cookies and authentication bring back the credential exposure the sandbox is meant to remove once real accounts are logged in.
- Hosted browser services process page content, screenshots, and any credentials outside the company network, and proxy features marketed for bypassing captchas and geo-restrictions can breach target sites' terms.
Recommendation
Assess sandboxed browser agents for internal automation such as end-to-end checks against staging, data collection from partner or public portals without an API, and form workflows on test systems. Set up the boundary first: one disposable VM or container per run, an egress allowlist, dedicated service accounts with least privilege instead of personal logins, human confirmation before payments, messages, or deletions, and retained screenshots and action logs for review. Include prompt-injection test pages in the pilot and measure how often the agent follows them.
Agents and AI browsers that act inside an employee's everyday browser profile are not covered by this rating; Gartner's December 2025 advice to block AI browsers for the foreseeable future is a reasonable default. For framework choice, see browser-use and Stagehand (Assess); for the same isolation pattern applied to code execution, see sandboxed execution for coding agents (Trial).
Sources
- Chrome sandbox
- browser-use sandbox quickstart
- Playwright isolation
- E2B remote browser
- Pulse 2.0: Browserbase $40M Series B
- The Register: ChatGPT agent
- Claude for Chrome
- Brave: Indirect prompt injection in Perplexity Comet
- TechCrunch: AI browsers may always be vulnerable to prompt injection
- The Register: Gartner recommends blocking AI browsers
Consulting
From radar to implementation
You have assessed the technologies — we help you bring them into production systems safely and measurably.
