Lightpanda Session Bridge gives AI agents real logins without exposing credentials

A developer has released Lightpanda Session Bridge, an open-source project that lets autonomous AI agents operate inside authenticated web apps by cloning the user's live browser session into an isolated headless browser, without passwords or tokens ever reaching the agent. The tool is described in detail in a post on dev.to by its author.

The authentication wall for agents

According to the post, agents that do real work on the modern web quickly hit the same obstacle: billing consoles, SaaS dashboards, and internal portals sit behind Google OAuth, SSO federations, passkeys, and biometric 2FA. A headless browser cannot tap a security key or answer an authenticator prompt, so builders fall back on poor compromises: hardcoding passwords into prompts or .env files, manually copying session cookies into configs, or driving the user's primary browser directly over the Chrome DevTools Protocol (CDP), which disrupts real work and risks hijacking other tabs.

The bridge's philosophy is that the human keeps the login ritual while the agent receives a runtime that is already authenticated. The author argues a session cookie is a safer unit of trust than a password: it is ephemeral, it can be revoked instantly by logging out from the main browser, and it is scoped to a single origin, whereas a password grants permanent and unrestricted access with no guarantee of where the string will travel once an LLM agent holds it.

Three components

The system has three layers. First, a Manifest V3 Chrome extension (with the diagram also showing Edge and Comet) requests only activeTab, cookies, and storage permissions. When the user clicks Sync, it captures cookies for the active domain and performs an automatic pairing handshake with the local relay, storing a shared cryptographic token without manual copy-paste.

Second, a Python relay, relay/server.py, bound strictly to 127.0.0.1:8765 acts as the security gateway. It enforces strict origin matching, normalizes __Host- and __Secure- cookie prefixes per RFC 6265bis, and translates cookie structures into Lightpanda-compatible CDP messages, including converting lowercase sameSite values such as lax to the PascalCase Lax that Lightpanda expects, avoiding -31998 InvalidEnumTag CDP crashes.

Third, the headless runtime itself: Lightpanda, an open-source browser engine written in Zig with V8 and purpose-built for AI automation. The author runs it inside WSL2 on port 9222, isolated from the Windows host, and reports fast execution with a much smaller memory footprint than a full Chromium.

Hardened against SSRF and local leaks

Because a local relay that accepts cookies is a natural privilege-escalation target, the author says it was treated as a hostile SSRF surface from the start. Measures listed in the post include zero logging of cookie names or values; hardcoded loopback-only binding; an identity-provider blacklist that rejects transfers aimed at accounts.google.com, login.microsoftonline.com, appleid.apple.com, github.com, and auth0.com; DNS and IP verification that drops localhost aliases, private subnets such as 10.0.0.0/8 and 192.168.0.0/16, and wildcard DNS services like nip.io; and a 60-second pinned DNS cache to defend against time-of-check to time-of-use rebinding. Callers hitting the pairing endpoint without a legitimate chrome-extension origin header receive an immediate 403. The author states the design is backed by nine automated security test suites covering private-IP rejections, CDP payload structures, and token enforcement.

What the agent actually does

Once the session is synced, agent scripts use a bundled lightweight Python SDK, lightpanda_client.py. It connects to Lightpanda's CDP WebSocket, attaches to or spawns the target page, which already carries the synced session, and evaluates JavaScript inside the authenticated context to extract data such as profile names, quota displays, or CSRF tokens from a dashboard.

Why it matters

Credential handling is one of the sharpest edges in agentic AI. An agent holding a password has unrestricted access, and prompts, traces, and logs are all proven places where secrets leak. Whether or not this particular project sees wide adoption, its pattern is notable: the human performs the login, and the agent inherits only a scoped, revocable, single-origin session inside an isolated runtime, with the LLM kept entirely outside the trust boundary. The caveats are real, since a synced cookie can still be replayed while valid and the approach depends on disciplined relay hygiene on each machine. But shifting trust away from permanent credentials toward ephemeral sessions is a design direction that agent builders wrestling with OAuth and passkeys are likely to study closely.