The Browser Is the Sandbox

Quick Overview

The primary security risk identified in a recent report by Paul Kinlen (January 5, 2026) is that giving AI agents unconstrained access to local file systems via browser APIs creates a critical security gap, as exemplified by the "Codo" proof-of-concept exploit, which allows agents to execute harmful code or delete data from the user's machine.

Key Points: A report by Paul Kinlen on January 5th, 2026, details a fundamental shift in how people think about AI security concerning file access. The exploit described allows an AI agent granted script access to a local machine's terminal to execute malicious code, such as deleting files or writing malicious scripts. The report highlights that browsers like Chrome and Edge support this file access via APIs, which is the core vulnerability. The Codo proof-of-concept demonstrated that an AI agent could be tricked into writing malicious files (like a tax return hacker) into a project directory if given write access. The three layers of file access—the file system API, the origin private file system, and the execution layer—are compromised when an agent has broad permissions. The proposed solution involves the browser enforcing strict security policies, like CSP, or ensuring AI agents cannot access sensitive areas like the source code directory, which is currently impossible. The report suggests a move away from trusting chat interfaces toward agents executing tasks, emphasizing that trust must be earned through rigorous testing rather than assumed.

Context: The discussion centers on a report released on January 5th, 2026, authored by Paul Kinlen, which addresses a significant security concern arising from the increasing capability of AI agents to interact with local systems. The core issue revolves around the trade-off between utility (giving AI agents the power to perform tasks like writing code or managing systems) and safety, specifically when these agents operate within the environment of a web browser, which traditionally serves as a sandbox.