Browser-use's Real Risk Surface Is the Browser Session

The first browser-use test should not be “can the agent click the button?” It should be “what exactly did the agent get permission to see, change, and reuse?”

The project has three different surfaces: the Python library (Agent, Browser, ChatBrowserUse), Browser Use CLI 2.0 for coding agents, and the lower-level Actor API (BrowserSession, Page, Element, Mouse). CLI 2.0 uses a persistent daemon and direct Chrome DevTools Protocol communication. That can reduce orchestration overhead, but it also makes the daemon socket, session history, browser profile, and local process permissions part of the security review.

My first run is deliberately boring:

python -m venv .venv

source .venv/bin/activate