Shopify opens Flow automation management to external AI agents — but not third-party apps
Shopify Flow becomes agent-operable for store owners, but its automation APIs are not a general third-party app integration.
Search
Search results for “browser automation security”
Find published research by company, product, platform or technology.
Showing 1–20 of 322 dossiers
npm v12 makes install scripts opt-in — while publishing automation gets a stage-only trust boundary
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
Firefox plans to stagger security fixes so AI attackers cannot combine unpatched browser bugs
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Gorgias' live-store benchmark finds ecommerce AI support automation is not the same as answer quality
Vendor-run live-store testing exposes the trade-off between containment, quality and response speed. Store configuration matters, and the evaluator's commercial conflict requires care.
GitHub Apps gain narrow repository-creation permissions and safer installation automation
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Cloudflare removes old Tunnel route endpoints — some Zero Trust automation now needs migration
The break is narrow but concrete: scripts and CI/CD calling the old route paths can fail, while monitoring code that expected `connections` inline must fetch it separately.
Shopify CLI 4.8 lets coding agents create and reset dev stores from the terminal
The useful shift is not another CLI convenience. A coding agent can now create a Shopify dev environment, populate it with existing API and bulk-operation tooling, test against it and tear it down without a person opening the Dev Dashboard.
Web DevelopmentCloud & InfrastructureDeployment & DevOpsDeveloper ToolsDatabases & StorageActive dossier
Railway makes Postgres recovery, HA and pooling machine-operable from its CLI
Agents and operations tooling can inspect HA health, trigger switchovers, restore to a timestamp and change connection pooling from one machine-readable surface. That increases automation power, but recovery actions still create real operational boundaries such as brief failover interruption and forked PITR services.
Tor Browser 16.0 moves to Firefox ESR 153, adds Linux ARM64 and retires 32-bit x86
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
Artificial IntelligenceWeb DevelopmentAI AgentsWordPressBrowsers & Web StandardsDeveloper ToolsActive dossier
WebMCP gives websites a structured tool layer for browser agents
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Artificial IntelligenceWeb DevelopmentAI CodingBrowsers & Web StandardsDeveloper ToolsActive dossier
Safari 27 gives coding agents a local MCP path into live browser debugging
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
Lightpanda 1.0 makes a Zig headless browser production-ready for agents and crawlers
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
Cloudflare Browser Run can now hard-limit agent sessions to approved hostnames
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
Artificial IntelligenceWeb DevelopmentBrowsers & Web StandardsInference & APIsDeveloper ToolsActive dossier
SwarmLLM splits a 27B model across browser tabs with WebGPU and WebRTC
SwarmLLM does not route whole prompts to separate machines; it pipelines one model across browser tabs. A MacBook and iPhone can jointly hold Qwen 3.8 27B even when neither device can hold the full 15GB quantized model alone, with no inference server in the loop.
Hugging Face releases 207 versioned WebGPU kernels for browser AI
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
WordPress Playground can now boot WordPress 0.7 through 6.2 in the browser
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
pgAdmin 4 9.19 patches 15 security flaws — server operators must check a one-time command migration
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
NativePHP Mobile patches seven security flaws — rebuilding and app-store releases are required
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
FrankenPHP 1.13.4 fixes seven security flaws, including unauthenticated worker-mode crash
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.