Browser freshness, containment, and the trust decisions coding agents make when they open pages you did not write.
Treat each AI agent as its own principal—scoped tokens, delegated permissions, one-agent revoke. Compare Mintive, Okta Govern AI Agent Identity, and WorkOS Agent Auth; draw the boundary vs an MCP gateway.
Chrome ships fixes; Playwright pins Chromium later. Decide by workload—own-app E2E, agent untrusted browsing, Playwright MCP—using chromiumSandbox, channel chrome, non-root hosts, and egress allowlists. A decision matrix for Claude Code, Cursor, and MCP.
Public GitHub repos block pull_request_target by default on December 2, 2026, with brownouts on November 9 and 16. Inventory workflows, switch CI to pull_request, and allow the trigger only for jobs that never execute fork code.
Decide when a coding agent should share your real Firefox logins versus driving a separate automation browser. Compare Kitsune, firefox-bridge, Playwright MCP, and Claude in Chrome on session model, profiles, and approval gates—without pretending modes stop prompt injection.