About Agent Browser Shield
Overview
Agent Browser Shield is a Chromium extension from PixieBrix that sits between a browser-use AI agent and the pages it visits, cleaning and securing each page before the model ever reads it. The extension processes the DOM locally so the agent sees page content without cookie banners, ad rails, hidden text, or other material that wastes context and steers it off task.
The project ships as a Manifest V3 extension with 35+ rules, an Astro documentation site, a Vite and React demo store called RiverMart that deliberately packs in every threat the shield targets, and a Python benchmark harness that compares agent runs with the extension off versus on. It is source-available under PolyForm Shield 1.0.0, and the maintainers label it an alpha prototype whose rulesets may change without notice.
Key Benefits
- Cuts token use by about 11% on average, measured with gpt-5-mini through Browserbase across 19 real-web tasks and three runs each.
- Raises task success from 81% to 91% on the same benchmark, and every listed clean win passed both with and without the shield.
- Saves the most context on noisy pages, reaching a 62% reduction on a weather.gov forecast and a 71% drop on GitHub's trending feed.
- Blocks prompt injection by suppressing hidden text, HTML comments, and user-generated content before it reaches the model.
- Masks PII and credentials inside the browser so sensitive values never leave the page for the model provider.
- Keeps rule processing local: the extension collects, stores, and sends no telemetry, analytics, or usage data.
How It Works
You install the extension from the Chrome Web Store or build it yourself: run bun install and bun run build inside extension/ to produce extension/dist/, then load that folder as an unpacked extension at chrome://extensions. From there the shield intercepts each page the agent visits, strips chrome and manipulative elements, masks sensitive data, and hands the cleaned tree to the agent. For automation runs, an optional build-time JSON override file sets which rules ship enabled plus reserved keys for a floating options button, a per-site enforcement denylist, and dev-mode trace recording; users then toggle individual rules on the options page, and the benchmark scripts report per-task token and accuracy deltas against a baseline.
Use Cases
- AI agent developers working with browser-use runtimes add the extension to stop agents from burning context on cookie banners, chat widgets, and sponsored rails.
- Security engineers use the injection-blocking rules to remove hidden text, HTML comments, and user-generated content that could carry prompt-injection payloads.
- Compliance teams enable PII and credential masking so personal data on a page never reaches a third-party model provider.
- Automation engineers on Browserbase package extension/dist/ as a ZIP and load it through the Browserbase extensions API for production agent sessions.
- Researchers and platform teams point the benchmark harness at their own task lists in CSV to get real token and accuracy deltas for the sites their agents actually visit.
- Web developers load the RiverMart demo store with and without the shield to inspect before-and-after behavior for each rule.
- OpenClaw and Claude Code users install the ClawHub skill or a bundled skill to load install paths, configuration, and runtime behavior contracts.
Why Choose This Product
The project publishes its method and its misses: the maintainers report per-task results for every site, keep a few pages that regress under the shield in the data, and call the 11% figure a directional signal rather than a published paper. Teams get a reusable harness that measures the effect on their own URLs instead of trusting a marketing number, plus a documented rule reference, install guide, and a mock store that reproduces 35+ rules locally. Note two stated limits: the shield reduces browser-agent threats but does not catch everything, and its license forbids using the code to build a competing product.
Agent Browser Shield Pros & Cons
- Published benchmark: ~11% fewer tokens and task success up from 81% to 91% across 19 tasks
- 35+ rules covering token stripping, PII masking, injection blocking, and dark patterns
- Runs on any Chromium-based browser, including Edge, Brave, Arc, and Opera
- No telemetry or analytics; rule processing stays local in the browser
- Open harness and per-task results you can rerun against your own URLs
- Alpha prototype: rulesets may change without notice
- License bars building a competing product on the code
- Reduces browser-agent threats but cannot catch everything
- A few pages regress in token use under the shield
Key Features
Page Chrome Stripping
Removes footers, cookie banners, chat widgets, and sponsored content so agent context goes to the user's task.
PII Masking
Masks personal data and credentials in the browser before any page content reaches the model.
Injection Blocking
Suppresses hidden text, HTML comments, and user-generated content that can carry prompt-injection payloads.
Dark Pattern Blocking
Hides manipulative dark patterns and engagement rails that pull the model away from the task.
35+ Rules
Ships over 35 individual rules, each toggleable from the extension options page.
Build-Time Overrides
Accepts a JSON override file that sets which rules ship enabled plus options-button, inactive-tab, and trace-recording defaults.
Site Denylist
Pauses every rule on hosts matching the configured URL patterns in the per-site enforcement denylist.
Benchmark Harness
Python scripts run extension-on versus extension-off scenarios over a task CSV and render per-task token and accuracy reports.
Debug Trace Export
Dev-mode trace recorder dumps a JSONL trace from the popup for diagnosing rule behavior in automation builds.
RiverMart Demo Store
A Vite and React mock e-commerce site exercises every rule so you can compare behavior with and without the shield.
Frequently asked questions about Agent Browser Shield
What exactly does Agent Browser Shield do to a page?
It sits between a browser-use AI agent and the web pages it visits, cleaning and securing each page before the content reaches the model. It strips page chrome such as footers, cookie banners, chat widgets, and sponsored content, masks PII and credentials, and suppresses hidden text, HTML comments, and user-generated content that could carry prompt-injection payloads.
How much does it actually save in tokens?
Across 19 real-web tasks with gpt-5-mini via Browserbase, three runs each, the shield saved about 11% of tokens on average and raised task success from 81% to 91%. Savings climb far higher on noisy pages: a weather.gov forecast dropped 62%, GitHub issue search 42%, MDN and Python docs 26% each, and the single biggest drop was 71% on GitHub's trending feed.
Which browsers and runtimes support it?
The extension is a Chromium Manifest V3 build and installs from the Chrome Web Store on any Chromium-based browser, including Chrome, Edge, Brave, Arc, and Opera. Loading an unpacked build requires Chrome or Chromium 148 or newer. For Browserbase sessions, package the build as a ZIP with bun run package and upload it through the extensions API.
Does the extension collect any data?
No. The extension does not collect, store, or send any telemetry, analytics, or usage data, and rule processing runs locally in your browser. The only outbound network call comes from the optional irrelevant-sections-redact rule, which is off by default and sends a compressed page tree to OpenAI's API when you enable it and configure an API key.
Can I control which rules run, or turn it off for certain sites?
Yes. Pass a flat JSON override file to bun run build to set which rules ship enabled by default. Reserved keys also let you add a floating options button, keep observing inactive tabs, start with trace recording on, and maintain a site denylist of URL patterns that pauses every rule on matching hosts.
Can I measure token and accuracy changes on my own sites?
Yes. Add your URLs and tasks to a CSV, then run scripts/benchmark_run.py with your scenarios file and tasks file, and render the results with benchmark_report.py. The harness runs the same off-versus-on comparison and writes a report of your real token and accuracy deltas to output/results/.