Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
The update also forces orchestrator-owned browser daemons to fail closed on shutdown instead of leaving a session open.
Why now: The release went up August 26, and it's a security-only patch with no new capabilities attached.
Browser-harness, the 17,145-star agent-browser project, released browser-harness's v0.1.10 release notes on August 26 at 00:49 UTC. Every item in it is about containment. None of it adds a new feature.
The headline fix, PR #639, redacts Chrome DevTools Protocol credentials from daemon logs. A CDP endpoint is full remote control of a browser session: navigation, cookies, form fills, the works. A credential sitting in plain text in a log file was a standing invitation to anyone who could read that log.
PR #640 changes what happens when an orchestrator-owned daemon shuts down. It now fails closed, so a crashed or killed orchestrator can't leave a browser session open for something else to pick up. PR #653 adds a machine-readable health check for daemons. Teams add checks like this after a daemon dies silently and leaves them guessing.
Two smaller changes round it out. PR #641 splits the screenshot response timeout from the IPC connect timeout, so a slow screenshot doesn't get misread as a dead connection. PR #642 lets teams suppress the Cloud live viewer.
Anyone running browser agents unattended, with no one watching the session live, should pull this release. The credential leak and the fail-closed shutdown are exactly the failure modes that show up when an agent runs overnight. Nobody checks its logs until something's already wrong.
The release notes don't say how long the CDP logging issue existed, or whether older log files need to be rotated out as a precaution. They also don't mention backporting the fix to older release branches, so anyone on a version before 0.1.10 stays exposed until they upgrade.
Each link below shares sources, entities, or timing with this story.
Shipped August 26, every notable item is about limiting damage rather than adding capability: CDP credentials redacted from daemon logs, orchestrator-owned daemons failing closed on shutdown, a machine-readable daemon health check, screenshot response timeout separated from IP...
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
Boundary-Bench ran 12 agent harnesses through real firewall and filesystem locks, and costs climbed as much as 167 percent as those restrictions tightened.
The open-source tool now sits at 98.9k GitHub stars and pairs a skill with a proxy that compresses code, logs and JSON before they hit the model.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
The GitHub advisory says the checker inspects the executable name only, ignoring every argument passed alongside it.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.