Browser execution, cloud planning, and credentials stay separate.
Keypilot gives the planner enough redacted context to propose one action while the extension keeps authority over tabs, approvals, and secrets.
Default boundary
Planner
Can propose a typed action.
Extension
Validates and executes that action.
User
Handles login and approves consequential steps.
This is a developer alpha, not a security certification. The model, extension, browser, provider site, and device remain separate trust dependencies.
Controls enforced by the extension
The model cannot return JavaScript. Every response must match the versioned Keypilot action protocol before the runner considers it.
| Control | Behavior |
|---|---|
| Origin boundary | Navigation and browser actions are limited to origins approved before the run. |
| Fresh observations | Element identifiers and fingerprints reject actions planned against stale page state. |
| Login handoff | Login fields, MFA, CAPTCHA, and challenge pages are withheld from the planner. |
| Action review | Buttons and credential capture pause for explicit user approval. |
| Action budget | Each run stops after 35 actions until the user resumes it. |
| No remote code | The extension bundles its executable code and accepts only schema-validated action data. |
The vault key exists only while the workspace is unlocked.
Vault records use AES-256-GCM with a random nonce. A non-exportable key is derived from the passphrase using PBKDF2-SHA-256 with 600,000 iterations.
Encrypted locally
- API keys and client secrets
- Model and cloud connection tokens
- Pending OAuth state and PKCE verifier
Stored as metadata
- Credential labels and origins
- Run history and status
- Agent settings and approved setup defaults
Known limits remain part of the decision.
Redaction can miss secrets rendered as ordinary page text. A malicious or compromised extension, browser, operating system, model provider, or device could still expose data.
- Removing the extension or browser profile can destroy a vault because cloud backup is not provided.
- Deleting a local credential does not revoke it at the provider.
- Provider interfaces and terms change, so recipes can become incomplete.
- The hosted planner processes redacted observations through Cloudflare Workers AI. Keypilot does not persist those request bodies in its application database.
- No external security audit has been completed for this alpha.
To report a security issue, email security@isolated.tech. Do not include live credentials or session tokens.