Is it safe to give an AI agent your real, signed-in browser?

Giving an AI agent your real, signed-in browser is a real decision, and it is fair to ask whether it is safe. We would rather answer plainly than promise something we cannot back up. This post says what Beacon does, what it does not do, and where the responsibility sits.

Beacon is an MCP tool. It does what the caller asks, and the caller is an AI agent following instructions from you. What happens depends on who is calling the tool and what instructions they have given.

That has a consequence worth stating directly. If you tell your agent to pay for something, it will. That is your instruction, not a failure of the tool. Beacon does not try to second-guess you, and it does not block any category of site, such as banking. Whether a task is a good idea is your call.

There are two limits that apply regardless of the task:

• The agent can only act inside its own tab group. It gets its own lane, and if it tries to act on another lane's tab or on your own tab, it receives a WRONG_LANE error instead of acting.
• Irreversible steps, such as sending a message or paying, are flagged so the agent can ask you first.

Neither limit is a guarantee that nothing can go wrong. The first keeps the blast radius to the tabs the agent opened. The second gives the agent a clear moment to stop and check with you. Both depend on the agent doing the sensible thing at that moment, which is why they are described as limits and flags, not as walls.

Your agent's commands, and what the page sends back, pass through the hosted relay to the extension. Treat that like any hosted service. If a page contains something you would not be comfortable sending through a hosted service, do not ask an agent to work on it. The privacy policy describes what Beacon collects.

A few habits make this safer in practice:

• Be specific. Tell the agent to stop before paying or sending, and it can ask first.
• Use agent mode when you want your own tab left alone while the agent works in the background.
• Keep sensitive and routine work in separate Chrome profiles if you use more than one, and name the profile in your request.
• Watch the Agent Board. You can see running agents and stop one at any time.
• Rotate your key from your account if you think it leaked, and paste the new config into your MCP client.

The reason to use your own Chrome is that your sessions are already there. That is also why it deserves care: the agent can reach what you can reach inside its own tab group. A fresh automated browser has nothing in it, which is safer in one sense and useless for any task behind a login.

Beacon sits in the middle. It gives the agent a bounded place to work, flags the steps that cannot be undone, and leaves decisions about what to automate with you.

If you want to try it, start with the setup guide. If you are worried about web pages that try to steer an agent, read prompt injection and browser agents.