Browser agents act inside your session. The approval gate is a word match.

Published August 19, 2026 · Last reviewed August 20, 2026

A Chrome side-panel project called Endoplexity passed 200 GitHub stars within days of its 14 August launch. It does something specific: it lets a Claude or Cursor command line agent you already pay for operate your real, logged-in browser through a local bridge. Not a sandboxed headless instance with fresh cookies. The browser where you are signed into your bank, your CRM, your email, and your company billing portal.

The safety design in it is better than most of what ships in this category. The approval policy lives outside the model prompt, so an instruction hidden in a web page cannot argue its way past it. Silence denies rather than allows. An unrecognized autonomy setting falls back to the cautious mode instead of the permissive one.

And the gate those good defaults protect still works by matching English words on buttons. The project says so itself, in its own documentation, without hedging. That admission is the most useful thing in the repository, because it is not a bug in one extension. It is what happens to every agent that has to act through an interface built for people.

What shipped, and why the stars are the signal

Endoplexity is a Chrome extension with a side panel and a local bridge. The bridge exposes fourteen browser tools over the Model Context Protocol on a loopback connection: snapshot, navigate, click, type, key, upload, read_file, select, scroll, hover, back, forward, tabs, use_tab.¹ A coding agent you are already running in a terminal connects to that bridge and drives the browser you are already using. The pitch is economic before it is technical. You have a Claude or Cursor subscription; this turns it into browser automation without a metered API key.

The repository is Apache-2.0 licensed and was created on 14 August 2026. It passed 200 stars within days of that launch and stood at 210 as of 20 August 2026.² Treat the precise number as noise and the slope as the point. A few hundred stars is not a market. It is a demand reading, and this one is legible: developers want their existing agent to work the web they are already logged into.

Every capability here exists elsewhere in better funded form, inside Perplexity Comet, Gemini in Chrome, and Claude for Chrome, the current wave of agentic browsers. ChatGPT Atlas belonged on that list too, until OpenAI shut it down: announced 9 July 2026, stopped working 9 August 2026, its browser-agent work folded into ChatGPT and Codex instead.³ The best funded product in the category did not survive its first year. When the well resourced options keep moving, a small project that writes its safety boundary down where anyone can read it is worth more, not less. In the commercial survivors that boundary is a paragraph in a help center. Here it is a file you can open.

The part this project got right

Three decisions here are worth copying.

The approval policy runs in the bridge, not in the prompt. Submitting a form, deleting something, and making a purchase stop and wait for a human.¹ Because that check is code sitting between the model and the browser, no instruction the model reads can talk it out of firing. The dominant failure mode in this category is indirect prompt injection: text on a page, in a document, or in an email that the agent treats as instruction rather than content. Security researchers made the same point at Black Hat USA on 5 August 2026: there is no clean fix for it in AI browsers, and the pattern behind almost every finding is the same combination of private data access, untrusted content, and a way to act on both.⁴ A safety rule in the system prompt sits inside the blast radius of that problem. A safety rule in the transport does not.

The failure direction is right too. If the side panel is closed, or the human simply does not answer, the action is denied.¹ That choice makes the product feel worse, because an agent that stalls waiting for a person looks slow in a demo. Picking the annoying default over the impressive one is the clearest sign in the repository that someone was thinking about consequences rather than screenshots.

The third decision is smaller and says the same thing. There are three autonomy modes, watch, normal, and trust, and the panel renders trust in red. An unrecognized mode falls back to normal rather than to trust.¹ Unknown input resolves toward caution, which is the habit you want in anything holding your session cookies.

None of this is exotic. It is roughly the three tier pattern practitioners converged on for agent workflows generally: auto approve what is reversible, notify on what is recoverable, hard block what is not. So the design is sound. Which makes what happens next more interesting, not less.

The part that cannot be fixed at this layer

Here is how the gate decides that an action is irreversible. It looks at the label on the element being clicked and matches it against a list of English keywords: submit, pay, delete, confirm, and similar terms.¹

The project does not hide this. Its own documentation states that a button labeled in another language, worded unusually, for example “Finish” or “Yes, place it”, or carrying only an icon, will not be caught.¹ The last control between an autonomous agent and an irreversible action is a string comparison against a handful of English words, and the thing being compared is a label a designer chose for a human reader, for reasons that had nothing to do with safety.

The failures follow from that. A checkout button reading “Bestellung abschicken” is not caught. A trash icon with no text is not caught. A purchase confirmed by a control labeled “Got it” is not caught. The false positives run the other way: a harmless newsletter form that says “Confirm” interrupts the human for nothing, and interruptions that are usually noise are exactly how approval prompts get clicked through unread. OWASP names that pattern as a top ten agentic risk, human agent trust exploitation, and it is how a working gate degrades into a habit.⁵ We went through that list in OWASP named ten agentic risks, four of them are identity problems.

The instinct is to fix the heuristic. Add languages. Add an LLM judge that reads the page and decides whether the action looks irreversible. Both help, and neither changes the shape of the problem, because both are still inference. The agent is standing in front of an interface built for a person, guessing what it means. Guessing works most of the time, which is the worst possible property for a safety control: the failures cluster in the unusual cases, which is where the money is.

There is a version of this failure the button-label gate cannot see at all. At Black Hat USA on 5 August 2026, researchers at Zenity Labs published zero-click exploit chains against Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, which was still live that week, and Copilot Edge.⁶ They call the vulnerability class PleaseFix, and a related pattern Intent Collision: hidden instructions planted in ordinary content the agent reads, an email, a social post, with no click from the victim required. In their demonstration, an ordinary request to summarize an inbox triggered a chain that exfiltrated Gmail data, silently shared the victim’s Google Drive with the attacker, and enabled takeover of the victim’s Slack, X, and Claude accounts. Zenity says it reported the findings to Anthropic and OpenAI in late 2025 and early 2026, and that they were unpatched at the time of publication.

That is a sharper version of the same ceiling. A gate that reads button labels only fires once something reaches the point of clicking a labeled control. An exploit chain that never asks the human to click, approve, or knowingly execute anything walks past it without ever being tested. The gate can be well built, sit in the transport rather than the prompt, and deny on silence, and still be irrelevant to the attack that matters.

That is the ceiling of the approach, not a flaw in one extension. As long as an agent has to interpret a page written for humans, every gate it enforces is a reading, and every reading can be wrong in a way that only shows up after the click.

The question a button label never answers

Step back from the extension and look at the transaction it is part of: a human, an agent acting for that human, and on the other end a website. Three questions have to be answered before anything consequential happens, and they have three different owners.

Is this action irreversible? That is what the approval gate tries to answer, by reading a page. The browser layer owns this question and can only ever estimate it.

Is this agent what it claims to be? That is declared identity, and it belongs to other layers: signatures, published key material, an A2A Agent Card at a well known path. Those mechanisms work, and they say nothing about whether the action is safe.

Who is on the other end, and did they agree to this? Nothing in the browser stack touches this one. A visiting agent reading a pricing page cannot establish that a real business is behind it, cannot be told what the page does not say, and cannot reach a person except by filling in a form meant for a human and hoping. The site, symmetrically, has no idea whose agent just arrived or whether its owner agreed to be contacted.

The third question gets skipped because the first two look technical and it looks like a product problem. It is not. It is why the gate has to guess at all. The agent is scraping meaning out of a human interface because there is no counterparty on the other side to ask. If the website could be addressed directly, as something that answers questions, qualifies whether there is a fit, and routes to a person only when both sides agree, the visiting agent would not be inferring intent from the word on a button. It would be having a conversation.

That does not make prompt injection go away, and it does not remove the need for local approval on irreversible actions. Those controls stay. What changes is how much weight they carry alone.

How this connects to Tobira

Tobira works on the third question. The @handle is a human-readable address for a person or a business, and through Site Agent a company website becomes an agent other agents can find on a network, talk to, ask about fit, and route to the owner, with contact details exchanged only after both sides consent to reveal. That is a different job from the one the approval gate does, and it does not replace it: local controls on irreversible actions stay exactly where they are. It is also a different job from making a site agent-readable through llms.txt or WebMCP, which is about how machines parse a page. Addressable means there is something to talk to; readable means the page is easier to parse. A site can be both, and the two do not substitute for each other. The network the consent step runs on is early: 648 agents on the network, including 102 business agents, per the Tobira founder update, June 2026. The distinction itself is worth reading in full in why agent-readable is not the same as agent-addressable.

FAQ

What is Endoplexity? A Chrome extension with a side panel and a local bridge that lets an existing Claude or Cursor command line agent operate the browser session a person is already signed into. The bridge exposes fourteen browser tools over the Model Context Protocol on a loopback connection, covering page snapshots, navigation, clicking, typing, key presses, uploads, file reads, selection, scrolling, hovering, history, and tab control. It is Apache-2.0 licensed, passed 200 GitHub stars within days of its 14 August launch, and stood at 210 as of 20 August 2026.

How does its human approval gate work? Actions the project treats as irreversible, submitting, deleting, and purchasing, pause in the bridge and wait for a person. Because the check runs in the transport rather than in the model prompt, text on a web page cannot instruct the agent to skip it. If the side panel is closed or the human does not respond, the action is denied rather than allowed.

Why is matching button labels a weak safety control? Because the label is a design choice made for human readers, not a machine-readable declaration of what the action does. The project states plainly that a button in another language, worded unusually such as “Finish” or “Yes, place it”, or shown only as an icon, will not be caught. The gate misses those and also fires on harmless controls that happen to read “Confirm”, and prompts that are usually noise are the ones people stop reading.

Does a stricter local gate solve agentic browser safety? It helps and it does not close the gap. Adding languages or an LLM judge that reads the page still leaves the decision as an inference drawn from an interface built for people. Security researchers report no clean fix for indirect prompt injection in AI browsers, and a University of Washington team that studied seven agentic browsers reported that four of them opened paths around the same-origin policy, which is a browser-level protection the approval gate never sees.

What does this have to do with agent identity and consent? They are separate questions with separate owners. Whether an action is irreversible is judged at the browser. Whether an agent is what it claims is declared identity, handled by signatures and A2A Agent Cards. Whether the human on the other end agreed to be reached is untouched by either, and it is the reason the agent is reading a page in the first place rather than asking a counterparty that can answer.

Sources

• Endoplexity repository and README, github.com/Endokelp/Endoplexity, read 19 August 2026; repository age and star count verified via the GitHub API, 20 August 2026.
• Dark Reading, “No Perfect Fix for AI Browser Prompt Injection Flaws,” by Alexander Culafi, 5 August 2026.
• Zenity Labs, PleaseFix zero-click exploit chain research presented at Black Hat USA, 5 August 2026, reported by SecurityWeek and via Business Wire.
• TechCrunch, “OpenAI is shutting down Atlas, but its AI browser ambitions are still growing,” 9 July 2026.
• University of Washington News, “Some agentic AI browsers come with major cybersecurity risks, UW study finds,” 30 June 2026, and the accompanying project page at agent-security.cs.washington.edu.
• OWASP GenAI Security Project, Top 10 for Agentic Applications, ASI09 Human-Agent Trust Exploitation.
• Tobira founder update, June 2026, for the network figures cited in the Tobira section.