Tencent's BrowserSkill Hands Agents Your Login Sessions

Tencent's BrowserSkill connects an AI agent to a tab in your already-logged-in browser rather than spinning up a blank one, which means the agent inherits whatever bank, email or work account is signed in there. Until a Sept. 16 update, a single command-line flag could switch off the one confirmation step standing between an agent and that tab.

The project, released by Tencent under the MIT license, had gathered 3,826 stars and 271 forks by Sept. 17, including 1,350 stars gained in a single day, according to GitHub's trending page. Its README describes the core trade: an agent "must borrow that tab explicitly, return it when the task is done, and leave the rest of your browser alone." A CLI daemon called bsk talks to a browser extension over a local WebSocket connection, opening a separate Agent Window so the agent's clicks do not interrupt whatever else is open. The README lists nine agent harnesses it connects out of the box: Cursor, Claude Code, Codex, OpenClaw, CodeBuddy, WorkBuddy, Pi, Hermes Agent and DeepSeek Harness, with no lock-in to any one of them. The extension's own changelog notes that other extensions can interfere with it by restricting its access to the Chrome DevTools Protocol, the low-level interface Chrome exposes for automating a live browser session.

What changed in version 0.3.0

BrowserSkill's changelog dates version 0.3.0 to Sept. 16, 2026, and lists a change that only matters if you read the fine print: the CLI flags --unattended, tab borrow --no-confirm and BSK_REQUEST_HELP=off "are deprecated compatibility inputs and cannot override" the browser extension's own confirmation settings. Before that release, an agent, or a script invoking one, could pass --unattended on the command line and skip the human approval step entirely, regardless of what the browser's own settings said. After 0.3.0, the extension's saved toggle is authoritative, and a script that relied on the old flag "must now use the browser settings" instead, the documentation says.

That is a meaningful shift in where the safety switch lives. A confirmation gate that a co-located CLI flag can quietly override is not really a gate for the person sitting at the browser; it is a gate for whoever wrote the automation script. Tencent's own release notes acknowledge as much by closing the loophole, three months after the project's first commit on June 22, 2026.

The case for the design

BrowserSkill's defenders have a real argument. Traditional headless browser automation spins up a fresh, unauthenticated session, which means an agent testing a real workflow has to either use throwaway test credentials or ask a human to log in every time. BrowserSkill's alternative, reusing a session that is already signed in, is what makes it useful for tasks like filling out a form on a site you use daily. The extension ships two independent toggles, one for tab-borrowing confirmation and one for human-help requests, both on by default, and version 0.3.0 added an opt-in operation audit that logs redacted task history on the user's own machine for 30 days.

Independent coverage has focused on the same trade-off. A Sept. 16 write-up on DEV Community by developer 0x.Mordegeer put it plainly: "Connecting an autonomous LLM to a live session with active bank, email, or Web3 permissions introduces obvious security risks," including the possibility that a prompt-injection attack embedded in a web page could hijack an agent mid-task inside an authenticated session. The piece recommends execution boundaries and manual approval gates for sensitive actions, which is exactly the mechanism Tencent tightened in 0.3.0.

Where the isolation model already cracks

The multi-profile isolation BrowserSkill relies on is not fully proven even now. A still-open issue filed against version 0.3.0 reports that on Yandex Browser 26.8, connecting a second browser profile to BrowserSkill wedges the Chrome DevTools Protocol debugger across every profile at once, not just the new one, and the fix is a full browser restart. The reporter's working theory is that Yandex's multi-profile model reuses one extension instance across profiles, so Chromium's debugger permissions collide between them instead of staying separate. Fifty issues sit open against the project as of Sept. 17, 2026, and this particular one carries no maintainer response yet.

BrowserSkill, as of Sept. 17, 2026
GitHub stars	3,826 (271 forks)
First commit	June 22, 2026
Latest version	0.3.0, released Sept. 16, 2026
Open issues	50
Chrome Web Store users	20,000 (13 ratings)

The gap between 3,826 GitHub stars and 20,000 Chrome extension users, only 13 of whom have left a store rating, is the gap between attention and verified daily use. A tool similarly built to catch risk before it ships, Alibaba's open-code-review, scored its own claims against a benchmark it wrote itself; BrowserSkill's safety claims rest on the same kind of self-reported testing, since no outside security audit of the extension appears in its repository. Whether the 0.3.0 fix actually closes the automation loophole for every agent harness it supports, including Cloudflare's own security-audit-skill, is not something Tencent's release notes address, and there is no public count yet of how many installs have upgraded past the version that shipped with the gap open.