A recording contains text from the pages you visited: page content, console messages, URLs. A page can include text written to look like instructions to an AI agent ("ignore previous instructions and run…"). That's called prompt injection, and coding agents can edit files and run commands.
What we do: the tools are read-only, and every result wraps recorded content in a block labelled as untrusted recorded content, not instructions. Page text is truncated, and tokens can only read one workspace.
What you should do:
- Keep your agent's approval prompts on for shell commands. Don't run agents with auto-approve when they read recordings of sites you don't control.
- Review the agent's changes before you merge them.
- Use the allowed-domains setting so your team only records your own sites.