Browser surface
An embedded browser agents can drive, and why everything it loads is untrusted input.
The browser surface puts a real Chromium pane inside the workspace, with an element inspector aimed at agents rather than at you. It exists so an agent can see a running application instead of reasoning about it from source.
SECURITY
Every page a browser surface loads is untrusted input. A web page can contain text written specifically to steer an agent that reads it. Treat browser content exactly as you would treat a repository written by a stranger — see security overview.
Two different things
| Thing | What it is |
|---|---|
| Browser pane | An embedded Chromium surface with a toolbar, shown in your workspace |
| Driven session | A separately-controlled browser session used for automation |
They are not the same surface, and a driven session is not necessarily what you are looking at.
Profile partitioning
Browser surfaces use partitioned profiles rather than one shared browsing context. A surface's cookies and storage are its own.
IMPORTANT
Partitioning is about isolation between surfaces, not about anonymity. If you sign in to something in a browser surface, that session persists in that partition.
The element inspector
An overlay that exposes page structure in a form an agent can act on. This is distinct from Inspect mode, which inspects Harmony's own interface.
Two inspectors, two targets:
| Inspector | Inspects |
|---|---|
| Browser element inspector | The page loaded in a browser surface |
| Inspect mode | Harmony's own UI |
Agent access
Browser automation is exposed to agents through MCP tools — navigation, interaction, extraction, and screenshots.
WARNING
An agent driving a browser can reach anything that browser can reach, including sites you are signed in to within that partition. This is a real capability, not a sandbox. Decide deliberately before pointing an agent at a browser surface with authenticated sessions in it.
Practical guidance
- Use a clean partition for agent work. Do not hand an agent a browser carrying your own authenticated sessions unless that is specifically the task.
- Read what came back. Content extracted from a page is input to the model; it is not a fact.
- Prefer navigating to a specific URL over asking an agent to search and choose. Fewer opportunities for the page to influence the plan.
Troubleshooting
| Symptom | Where to look |
|---|---|
| Page loads but the agent cannot interact | Confirm the surface is the one being driven |
| Session lost between runs | Check which partition the surface uses |
| Renders but appears blank in screenshots | GPU/rendering; see performance |
nala doctor