Detect and monitor AI agents in your browser.
Chrome extension that detects when AI agents take over your browser and logs what they do. It blocks scripted actions best-effort for in-page automation, and for external frameworks like Playwright and Computer Use it detects, alerts, and closes the agent tabs on command. Zero network requests by default, all processing local.
Open chromewebstore.google.com and click InstallFree. No account required. Works in any Chromium browser.
AI Browser Guard
Status. Active
[!] Agent detected on current tab
Framework. Playwright
Signals. WebDriver flag, CDP connection, synthetic events
Confidence. High
Enforcement. Monitor only (external CDP driver)
[*] Session. bank.example.com
Coverage. Page-level. Native CDP input is not observable
Actions. Detection and alerting active
[Kill switch closes the agent tab. Ctrl+Shift+K]Why a browser layer
Playwright, Puppeteer, Selenium, Anthropic Computer Use, and OpenAI Operator can all control your browser. AI Browser Guard detects them without requiring the agent to identify itself.
Without AI Browser Guard
- AI agents take over your browser silently via CDP, WebDriver, or automation frameworks.
- No visibility into what actions the agent is performing.
- The agent can navigate to any site, submit forms, and download files.
- No way to stop a runaway agent without killing the entire browser.
With AI Browser Guard
- Agent takeover detected automatically via multiple independent signals.
- Agent actions logged with timestamp, target, and outcome.
- Delegation boundaries enforced best-effort for in-page automation. Site restrictions, action limits, time bounds.
- Kill switch closes the agent tabs to interrupt an in-progress action.
Scope of enforcement
Detection and monitoring work across every framework. Per-action blocking does not. An installed extension cannot apply per-action policy to an external framework that drives the browser over CDP, so the scope is stated plainly.
Every detected agent
- Detection across Playwright, Puppeteer, Selenium, Computer Use, and Operator.
- Session monitoring of page-level actions, with a coverage note when native input is not observable.
- Boundary alerts for in-page automation.
- A kill switch that closes the tabs the agent controls.
In-page automation only, best-effort
- Per-action blocking of scripted navigations, form submissions, clicks, and typing.
- New-tab opens and downloads under an active delegation.
- Agent DOM writes and agent network egress.
- Bypassed by external CDP frameworks, which act via native input the page realm cannot intercept.
The only categorical prevention is a managed-Chrome policy, RemoteDebuggingAllowed=false. Modern Chrome (136 and later) already blocks remote debugging of your default profile by default. Treat the kill switch as the hard stop for an in-progress action.
Five core features
Detection, delegation, best-effort in-page enforcement, alerting, and logging. Everything runs locally in your browser.
Agent takeover detection
Multiple detection signals run in parallel. WebDriver flags, CDP markers, behavioral analysis (event timing, click precision, typing cadence), and framework specific fingerprints. No agent self identification required.
- WebDriver and CDP flag monitoring
- Synthetic event pattern detection
- Framework fingerprinting across five frameworks
- Works without agent cooperation
Kill switch that closes agent tabs
One click stop. It closes the tabs the detected agent controls, which interrupts the in-progress action, revokes active delegations, and dispatches a page-realm stop to in-page automation. A persistent external CDP driver can reopen a tab, so the categorical stop is a managed-Chrome policy. Visual confirmation in the popup.
- Keyboard shortcut Ctrl+Shift+K or Cmd+Shift+K
- Closes the tabs the agent controls
- Interrupts the in-progress action
- Revokes active delegations
Delegation wizard
Define what an in-page agent can and cannot do before it gets access. Three presets. Read Only navigates and reads only. Limited targets specific sites with a time bound. Full Access permits everything with logging. For an external CDP framework a preset is a recorded intent, not an enforced boundary.
- Three presets. Read Only, Limited, Full Access
- Site allowlist and blocklist via glob patterns
- Action type restrictions, best-effort in the page realm
- Time limits with countdown of 15 min, 1 hr, 4 hr
Boundary violation alerts
Fail closed rule evaluation for in-page automation. Scripted actions are compared against active delegation rules and blocked best-effort in the page realm before execution. A Chrome notification fires for each block. External CDP frameworks act via native input the page realm cannot intercept, so per-action blocking does not apply to them.
- Best-effort block before execution, in the page realm
- Real time Chrome notifications
- What was attempted and which rule blocked it
- Option to allow once per violation
Session timeline
Chronological log of every page-level agent action per session. Each entry includes timestamp, action type, target URL, target element via CSS selector, and outcome of allowed or blocked. A session driven by an external CDP framework shows few or no actions because its native input is not observable, and the report states this. Last five sessions retained.
- Per session chronological log
- Action type, target URL, and element
- Allowed or blocked status per page-level action
- Last five sessions stored locally
How detection works
A multi stage pipeline runs on every page load. Each stage operates independently, so detection succeeds even if an agent evades one layer.
Privacy first
By default, AI Browser Guard makes zero network requests. All detection and processing happen locally on your device. Optional community-intelligence features (trust lookups and anonymized contribution) are off by default and send data only after you enable them.
Zero network requests by default
A fresh install makes no external calls. No analytics, no telemetry, no crash reports. Three community-intelligence features (trust lookups and anonymized contribution) are opt-in and off by default.
Local storage only
All data stored in chrome.storage.local on your device. Sessions, rules, and settings never leave your machine. Uninstall deletes everything.
Open source
Apache 2.0 licensed. Full source code on GitHub. Audit every line. No obfuscated code. No hidden behavior.
Quick start
Install from the Chrome Web Store for automatic updates, or build from source for development.
Build from source
For development
Clone, build, and load as an unpacked extension in developer mode.
View on GitHub# Clone the repository
$ git clone https://github.com/opena2a-org/AI-BrowserGuard.git
$ cd AI-BrowserGuard
# Install dependencies and build
$ npm install
$ npm run build
# Load in Chrome
1. Open chrome://extensions
2. Enable Developer Mode (toggle in top right)
3. Click "Load unpacked"
4. Select the dist/ directory
# Run tests
$ npm run testArchitecture
Chrome Manifest V3 extension with three coordinating components.
Content script
Injected into every page. Runs the detection pipeline, and applies delegation rules to in-page automation best-effort in the page realm.
Background service worker
Manages session state, delegation rules, and chrome.storage.local. Coordinates between content scripts and the popup. Handles kill switch execution.
Popup UI
Displays detection status, active delegation rules, violation log, and session timeline. Hosts the kill switch button and the delegation wizard.
Permissions
Every permission has a specific purpose. No optional or broad permissions requested.
| Permission | Reason |
|---|---|
| storage | Persist sessions, rules, and settings locally |
| alarms | Delegation expiration timers |
| notifications | Boundary violation alerts |
| debugger | Detect CDP client attachments. Layer 1 detection |
| <all_urls> | Detect agents on any page the user visits |
Install AI Browser Guard
Take back visibility into your browser. Detect AI agents, monitor what they do, and close their tabs when you need to stop.
Open chromewebstore.google.com and click Install