Agent/MCP Audit Sprint

Public AI agent scan brief

browser-use/browser-use AI agent security scan

Partial no-execution triage for the public browser-use repo. This is a heuristic scan of 90 selected public text files, not a commissioned audit, vulnerability disclosure, or security certification. These are not confirmed vulnerabilities.

Rerun public scan Browser audit path AI agent audit path Start audit from Radar
Repobrowser-use/browser-use
Score62/100 heuristic
Snapshot90 selected public text files
Signals1 high / 2 medium / 0 low

Top findings

Browser agents need explicit session and credential boundaries

The scan snapshot saw 99,596 stars and review signals around credential handling, remote browser or sandbox entry points, and write-action test visibility. A paid review would validate real source paths, runtime defaults, redaction behavior, browser session controls, and launch notes.

HighCredential signals detected without redaction signals.
MedRemote listener needs explicit exposure policy.
MedWrite actions should have confirmation and test coverage.

Evidence slice

Files that triggered review signals

Credential and workflow signals appeared in workflow and eval paths such as `.github/workflows/claude.yml`, `.github/workflows/cloud_evals.yml`, `.github/workflows/docker.yml`, `.github/workflows/eval-on-pr.yml`, and `.github/workflows/publish.yml`.

Browser and remote runtime signals appeared near `browser_use/skill_cli/README.md`, `examples/browser/playwright_integration.py`, `examples/browser/using_cdp.py`, `examples/integrations/agentmail/email_tools.py`, and `examples/sandbox/example.py`.

Validate redaction at logger, error, telemetry, and tool-output layers.
Document local-only versus remote listener defaults before deployment.
Test destructive browser actions, downloads, and authenticated session handling.

Paid handoff

Convert this scan into a fixed-scope review

  1. Confirm the current browser agent surface, deployment mode, and credentials in scope.
  2. Review page content, click, form, download, cookie, and JavaScript execution boundaries.
  3. Validate redaction, auth gates, allowlists, and regression tests against current source.
  4. Pay USD $1,000 only after written scope acceptance.
Start AI agent audit Open quote Back to AI Radar