The cloud browser runs in a separate cloud computer and does not inherit your normal browser session. Treat it like a delegated remote browser: grant only the sites needed, never paste secrets into ordinary chat, and review consequential actions before they are submitted.
1. Describe the website, desired outcome and boundaries before navigation starts
State the exact website, goal and forbidden actions before navigation starts. A narrow instruction such as “compare three refundable fares but do not book” is safer and easier to review than “handle my trip.”
2. Approve access only to the sites that are necessary for the task
Limit browsing to the minimum set of domains needed for the task. If a page redirects to a new service, verify why it is needed before allowing the workflow to continue there.
3. Use the secure sign-in flow and complete two-factor authentication yourself
Complete passwords, passkeys and two-factor authentication yourself through the secure sign-in flow. Do not paste credentials, recovery codes or payment secrets into the conversation.
4. Watch for confirmation prompts before bookings, payments, submissions or account changes
At checkout, booking, submission or account-change screens, read the final values yourself: recipient, amount, dates, cancellation terms and irreversible effects. Treat this as a human approval gate, not a formality.
5. Review the final page, receipt or saved result and take over whenever the site or task becomes sensitive
After the action, verify the result on the destination site—confirmation page, reservation record, sent message or account state. Save the confirmation identifier when one exists so completion is independently provable.
Use the cloud browser to [goal] on [site]. You may browse and fill non-sensitive fields. Stop before any purchase, booking confirmation, form submission, message send, account change or other consequential action and show me exactly what will happen. If login is required, pause for me to take over.
Assuming the cloud browser already has your logins; auto-approving every website; letting the agent submit a high-impact action without review; typing passwords into chat; believing every site permits automated browsing.
Finish check
The browser task stayed inside the approved sites, sensitive authentication stayed under your control, and every consequential action had an explicit human review point.