Agent safety

What an AI agent can do in Lilo without asking, what needs your approval, how agents stay apart from your tabs and Private Spaces, and the limits.

Lilo lets the AI agents you already run on your Mac, such as Claude Code, Codex or Cursor, drive a browser through its MCP server. This page explains how Lilo keeps those agents apart from your own browsing, which actions wait for your answer, and what the protections do not cover, so you can decide how much to let an agent do. To connect an agent, see AI agents.

Two kinds of agent use Lilo, and they are not kept apart in the same way:

An agent you connect from another app (Claude Code, Codex, Cursor or any MCP client) works in an Agents Space, in a throwaway profile, and reaches your sign-ins only after you allow one of your profiles. Most of this page is about it.
An agent you talk to in a Lilo conversation (File > Ask an Agent, ⇧⌘A) is a program Lilo starts on your Mac, with your user account’s access to your files and commands. In the browser it works in your own Space, with that Space’s profile and your sign-ins, from the start. Lilo’s protections cover only what it does in the browser. See Agents in a Lilo conversation.

Off until you turn it on

Lilo has no AI of its own. Nothing can drive Lilo until Let agents use Lilo is on in Settings > Agents. It is off on a new installation, unless you answered With my agents or For developing when the setup asked How will you use Lilo?: those answers turn it on. The setting applies to every profile. While it is off, an agent that tries gets an error telling you to turn it on.

Once it is on, agents reach Lilo through lilo-mcp, a small MCP server inside the app, over a Unix socket in Lilo’s support folder that only your user account can open. Nothing listens on the network.

Each agent is approved once

The first time an agent connects from another app, Lilo asks you whether to allow it. The approval is tied to the program behind the connection, not to the name the agent announces: its code signature (signing identifier and team) when Apple’s certificate chain vouches for it, or its executable path when it is unsigned. Another program cannot borrow an approved agent’s name to get in.

Settings > Agents lists the apps you approved under Apps that can use Lilo; Remove revokes one, along with the profiles you let it into.

This guards against a program pretending to be an agent you approved. It does not protect against malware already running as you: anything running under your account can still read Lilo’s data on disk.

A Space and a profile of their own

An agent you connect from another app does not work in your tabs. It opens its tabs in a folder of an Agents Space, one folder per task. By default that Space uses a separate “Agents” profile with none of your cookies, sign-ins or history. Lilo wipes that profile when agent control starts and when the last agent working in it leaves, so what one agent left behind never reaches the next. An agent never takes your keyboard or your tabs.

Your other tabs are out of reach. An agent sees and acts only on the tabs of its own folders. It never sees your other tabs.
Private Spaces are out of reach. An agent can never see or act on one of your Private Spaces, nor learn which profile it is based on. An agent can open an isolated tab, which lives in a Private Space of the agent’s own, apart from yours, and shares no cookies with the agent’s other tabs.
Your profiles need your permission. Some tasks need your sign-ins. An agent can ask to work in one of your profiles; Lilo asks you first, once per agent and profile. Once allowed, its tabs move to that profile’s own Agents Space (each profile agents work in gets one) and load with that profile’s cookies. Without asking, any agent you approved can list your profiles’ names and see which one you are using, unless you are in a Private Space.

What an agent can read in its own tabs: the page text, the accessibility tree, screenshots, the console, network requests, and the cookies of the sites those tabs show, HttpOnly ones included. Since an agent can navigate a tab to any site, an agent working in one of your profiles can read any site’s cookies there. Its fetch tool never returns Set-Cookie or Authorization headers.

Agents in a Lilo conversation

An agent you start yourself in a Lilo conversation (File > Ask an Agent, ⇧⌘A, once Conversations with your agents is on) is not kept apart like that. Lilo starts the agent’s own program, such as Claude Agent, Codex or Gemini CLI, on your Mac, in the working folder you pick for the conversation: No Folder, the first choice, gives it a folder of its own in Lilo’s support folder, and Choose folder… takes any folder; in a repository where another conversation’s agent is working, it gets a git worktree of its own. The folder is where it starts, not a limit on what it can reach. Lilo gives it browser tools only: it reads and edits files and runs commands with its own tools, with your user account’s access.

On your Mac, the agent’s own rules. What it does outside the browser is limited only by the agent’s own permission questions, which appear in the conversation as Allow this action?, with Allow and Don’t Allow. When the agent offers them, the Allow button’s menu also holds Always Allow (⌥↩) and Never Allow: one such answer stops the questions for that kind of action. Which actions it asks about is up to the agent. By default Lilo replaces the agent’s own prompt with Lilo’s (System prompt set to Lilo in Settings > Agents, under Conversations), for agents that accept a replacement. Lilo’s default text tells the agent that it has full access to your machine and to act instead of asking for confirmation when a request is clear, except before an action that cannot be undone and reaches beyond your Mac, such as pushing code, deleting remote data, sending messages or spending money, unless you already asked for it. You can edit that text in Settings, or choose Agent’s own to keep the agent’s prompt, which asks before more of its actions. Nothing else on this page limits what it does outside the browser.
No connection question. Lilo does not ask whether the agent may control Lilo.
Your Space and your sign-ins. The conversation is a folder of the Space you started it in, and the pages its agent opens go in that folder. They load with that Space’s profile: your cookies and sign-ins are there from the first page. They stay in that profile: to work in another one, start the conversation in a Space of that profile, or move the conversation to one, and the agent’s next tabs open there. A conversation never starts in a Private Space.
In the browser, only its folder. Its browser tools reach only the tabs in its conversation’s folder, and the isolated tabs it opens, not your other tabs. The page you are reading when you press ⇧⌘A comes along, and @ adds more. What you attach to a message reaches it too: a tab as its page text (up to 50,000 characters), a folder as the text of its tabs, a selection as its text, a screenshot as an image, a text file of 100,000 bytes or less whole, and any other file as a link.
The same questions before acting in the browser. The questions below, before a click or Enter that sends, pays or deletes and before a fetch that changes something, apply to its browser tools as to any agent’s, and so do their limits.

Its browser tools work only while Let agents use Lilo is on. If you want an agent to browse without your sign-ins, connect it from another app instead. You can also ask it to open isolated tabs, but that is a request to the agent: nothing makes it do so.

What waits for your answer

Unless you turn off Ask before sending, paying, deleting or publishing in Settings > Agents, Lilo stops an agent before:

a click or Enter whose wording looks consequential: a click (left_click, double_click or triple_click) or an Enter on a button, link or form whose label, or the address the form submits to, contains one of a fixed list of words such as “send”, “pay”, “delete” or “publish”. It is a best-effort check on the control’s wording, not an understanding of what the click does, and other kinds of control are not checked at all: see How Lilo recognizes a consequential action for the list and the gaps. It applies inside frames too. A click at a point that lands in a frame of another origin, which Lilo cannot read, is always asked; a click on an element by its reference (ref) is checked by its wording inside whichever frame holds it;
a request that carries your cookies: a fetch other than GET or HEAD sent from one of your own profiles.

A prompt opens under the address bar, naming the agent, the action and the site, with three answers: Allow Once, Always Allow on This Site and Don’t Allow. The agent waits. If nobody answers within 45 seconds, the action is refused, and the agent is told that it needs you.

Sites you always allow are listed under Always allowed in Settings > Agents, subdomains included, and you can remove them there.

Uploads always ask. Before an agent hands a page one of your files (file_upload, upload_image with a file path, or a network_mock rule that serves a file), Lilo asks every time, whatever the setting above, and offers no “always allow”. This prompt covers giving a file to a page only: it does not stop an agent from reading your files itself, as Local files explains.

How Lilo recognizes a consequential action

Lilo looks for the control the click or Enter would trigger: a button, a link, a submit, button or image input, or an element with the role button, link or menuitem. It reads that control’s label and the address the form would submit to, and looks for one of these whole words: “send”, “pay”, “payment”, “buy”, “purchase”, “order”, “checkout”, “delete”, “transfer”, “publish”, “post”, “tweet”, “reply”, “sign up”, “register”, “subscribe” or “donate”, and their French equivalents. The list is fixed. So:

A click on any other element does not prompt, whatever its label: a custom control built from a div or span without one of those roles, a checkbox, a radio button or a select, for example.
A label not on the list does not prompt, unless the form’s address contains a listed word: “Submit”, “Confirm”, “Remove”, “Save”, “Share” or “Unsubscribe”, for example.
A button labeled in another language than English or French, or with only an icon and no accessible name, does not prompt either.
Enter in a message box does not prompt. Lilo checks Enter only on a focused button or link, or in a single-line text field that belongs to a form. Enter in a multi-line field or a rich text editor, which is how most chat and comment boxes send, and Enter in a field outside a form, go through without a question.
Only clicks and Enter are checked. Space on a focused button, form_input, the insert_text action and a drag are not.
A harmless button whose label contains one of these words prompts anyway.

What the gate does not cover

The approval prompt is a safety net for well-behaved agents, not a sandbox.

Code the agent runs itself is not checked. An agent can run JavaScript in its tabs (javascript_tool) and send Web Inspector commands (devtools_command). That code can click, submit and send requests without any prompt. In one of your profiles, it acts with your sign-ins. A run program is different: it runs in a blank page of its own, with no cookies or sign-ins, and each tool it calls asks as it would alone, but it can call javascript_tool.
A conversation agent’s own tools are not Lilo’s. Its file and command tools answer only to its own permission questions, as Agents in a Lilo conversation explains.
Requests from the Agents profile are not gated. A fetch from the Agents profile carries none of your cookies, so Lilo does not ask before it.
Cookies can be written without asking. The cookies tool’s set action writes a cookie for any domain into the profile the agent works in, with no prompt. Reading and deleting reach only the cookies of the sites its tabs show.
Local files can be read without asking. See Local files.
Approval is per action, not per intent. Lilo cannot tell whether a task is what you wanted; it can only stop at the steps listed above.

So the safest setup keeps agents in their own Agents profile, and lets one into your profiles only for tasks you trust it with. Remember that a conversation agent starts in your profile, and runs on your Mac with tools Lilo does not check.

When an action may have gone through

If a tool call fails after it sent something that can change a site (a click, Enter, or a fetch other than GET, HEAD or OPTIONS), Lilo marks the error as a possible commit. The agent should read the site back before trying again, so it does not, for example, place an order twice.

Local files

An agent can read your files without asking. navigate loads any address, file:// ones included, in the agent’s own tab, and the agent can then read what the tab shows with get_page_text, read_page or a screenshot. That works for any file Lilo can read, and a folder shows its listing. No prompt guards it: the upload prompt covers only handing a file to a page, not opening one in a tab.

What a file:// page can load depends on its kind. An HTML page (.html, .htm, .xhtml) may load images, styles and scripts from any folder of your Mac, as in Chrome, so generated documentation that links to ../style.css works; WebKit still blocks its fetch and XMLHttpRequest of other files. Any other file, an SVG or a text file included, can read only itself.

Learn more

AI agents: connect an agent and use Conversations.
MCP tools: every tool an agent can call, with its parameters.
Privacy: what agents and everything else in Lilo send, and where.
SECURITY.md: how to report a vulnerability, including in agent control.