---
title: "Give browser agents their own profile and · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/separate-agent-browser
id: AID-71
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1016
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give browser agents their own profile and test accounts

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-71
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: An agent that drives a browser uses its own profile, signed in only to test accounts for the sites the task needs. It never uses a profile signed in to mail, banking, cloud consoles or admin pages.
- Check: In the agent's browser profile, open the team's mail, cloud console and admin pages. Each one asks for a sign-in. The profile's site list, or the driver's network rule, allows only the app under test and its sign-in host.
- Risk: An account or system taken over
- How: Browser extensions for agents share the browser's sign-ins, so the agent can act on any site you are signed in to. One page with hidden instructions can then make it read your mail or change cloud settings. Create a separate profile, or a fresh context in a browser driver such as Playwright, for agent work. Sign it in to test accounts that hold made-up data. Limit the sites it may open to the app under test and its sign-in page, in the extension's site settings or the driver's network rules. Handle sign-in pages and CAPTCHAs yourself. Treat everything the agent reads in the browser as [untrusted](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const ALLOWED_HOSTS = new Set(['staging.example.com', 'login.example.com']);

const browser = await chromium.launch();
const context = await browser.newContext({ storageState: 'test-accounts/agent-user.json' });
await context.route('**/*', route =>
  ALLOWED_HOSTS.has(new URL(route.request().url()).hostname) ? route.continue() : route.abort());
```

### Python example

```python
from urllib.parse import urlparse

ALLOWED_HOSTS = {"staging.example.com", "login.example.com"}

browser = playwright.chromium.launch()
context = browser.new_context(storage_state="test-accounts/agent-user.json")
context.route("**/*", lambda route: route.continue_()
              if urlparse(route.request.url).hostname in ALLOWED_HOSTS else route.abort())
```

## Sources

- [Claude Code, use Claude Code with Chrome](https://code.claude.com/docs/en/chrome)
- [OWASP LLM01:2026 Prompt Injection](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md)

## Related rules

- AID-28 [Treat what the agent reads as untrusted](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/separate-agent-browser">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give each subagent only the tools its job needs](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/subagent-tool-limits.md)
- Next: [Keep publishing rights away from agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-publish-rights-for-agents.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)