Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Browser Use (YC W25) – open-source web agents

github.com

Post reply on HN
Print view View original

101–107 of 107 posts

Re: Launch HN: Browser Use (YC W25) – open-source web agents

#101

Post by rainforest »

arjunchint wrote: post #99
rainforest wrote: post #84

Earlier quoted context omitted.

Could you go into a bit more detail about this? Why is exposing devtools to the agent a problem? What's the attack vector? That the agent might do something malicious to exfil saved passwords?

Forget the agent, browser-use's published setup instructions to use with your own Chrome profile and passwords [ https://docs.browser-use.com/customize/real-browser , https://github.com/browser-use/browser-use/blob/495714e2dd38... ] launches a Chrome session with Remote Debugging enabled. These tools they are guiding users to setup and execute are "inherently insecure" [ https://issues.chromium.org/issues/40056642 ].…

Thanks, for the benefit of others the risk is that the devtools port has no Auth so is vulnerable to XSS.

I would surmise that this will stop being a problem if you switch to using a unix socket for the CDP.

Re: Launch HN: Browser Use (YC W25) – open-source web agents

#103

Post by nsonha »

nostrebored wrote: post #30
gregpr07 wrote: post #26

Earlier quoted context omitted.

hmm, I though about this a lot. But tbh I think MCP is sort of a gimmick... probably the better way is for agents just to understand the http apis directly. Maybe I'm wrong, very happy to be convinced differently. Do you think MCP server for the cloud version would be useful?

strong agree with this -- I don't understand outside of integration with Claude Desktop why to use MCP rather than a dedicated API endpoint.

as building blocks we of course prefer APIs. However, interfacing directly with the browser (or desktop) can enable end users to do way more things without having integration built by devs, in theory at least. In reality, LLM may not have reached that point yet and there are security concerns.

Re: Launch HN: Browser Use (YC W25) – open-source web agents

#105

Post by deadfece »

jackienotchan wrote: post #14

AI agents have lead to a big surge in scraping/crawling activity on the web, and many don't use proper user agents and don't stick to any scraping best practices that the industry has developed over the past two decades (robots.txt, rate limits). This comes with negative side effects for website owners (costs, downtime, etc.), as repeatedly reported on HN. Do you have any built-in features that address these issues?

In my experience these web agents are relatively expensive to run and are very slow. Admittedly I don’t browse HN frequently but I’d be interested to read some of these agent abuse stories, if any stand out to you. (I’ve been googling for ai agent website abuse stories and not finding anything so far)

Re: Launch HN: Browser Use (YC W25) – open-source web agents

#107

Post by cdolan »

gregpr07 wrote: post #29
xnx wrote: post #13

Is it possible to mix browser-use with traditional DOM/XPath/CSS-selector automation? e.g. Have certain automation steps that are more fuzzy/AI like "click on the image of a cat"

We are experimenting with this. Currently the library api is very raw but technically possible (we introduced this notion of initial actions, which are just deterministic actions before the LLM kicks in) - https://github.com/browser-use/browser-use/blob/main/example... . The other way to achieve this with Browser Use is to save the history from `history = agent.run()` and rerun it with `agent.rerun_history(history)`.…

Would be fantastic to convert the agent history into deterministic crawlers/scrapers (playwright typescript, etc)

Ran into a tool called Promptwright on the Discord that was an example of this

Post reply on HN