Todd Schiller - PixieBrix

agent-browser-shield June 3 update: 14 new rules and the Chrome Web Store listing

2026-06-03T00:00:00-04:00

Two days after the alpha announcement, agent-browser-shield has a Chrome Web Store listing and 14 new protection rules.

Install from the Chrome Web Store

The extension is live at chromewebstore.google.com/detail/agent-browser-shield. One click instead of unpacked-from-source. The prebuilt ZIP and source-build paths stay for Browserbase and other runtimes that need an unpacked extension.

New rules: handling prompt injection and context pollution in invisible surfaces

A browser-use agent reads surfaces a sighted user never looks at. The new rules close them:

<noscript> blocks (never rendered with JS on, but agents walk them)
Poisoned <meta> description and <title> (the compact "what is this page" answer many agents pull first)
JSON-LD <script> blocks (cited as the "trusted summary" of a page)
aria-label, alt, title, placeholder, and SVG <title> / <desc> / <text> (a11y-tree carriers)
Unicode tag characters, bidi overrides, and zero-width payloads
Long base64 / hex / percent-encoded blobs (the "decode this and follow it" pattern)

New rules: trust laundering

link-spoof-annotate flags Cyrillic homoglyphs and anchors whose visible text doesn't match the href apex. disguised-ad-flag collapses native advertorials (Sponsored / Paid Post) that share DOM shape with editorial. trust-badge-annotate and schema-trust-sanitize ship off by default while we assess their false-positive rates.

The daily-driver surprise

I've started running it on my own daily-driver browser, not just agent runs. There have been some funny quirks (e.g., flagging GitHub issue links with ".md" in the link text as suspicious and hiding the GitHub issue template modal). However, overall it's been a positive on my browsing experience. So, we'll be experimenting with making more annotations visible to humans and multi-modal LLMs.

⭐ https://github.com/pixiebrix/agent-browser-shield

Introducing agent-browser-shield (alpha): keeping AI agents safe in the browser

2026-06-01T00:00:00-04:00

There are 6 billion internet users. With AI agents, we're quickly heading to 60 to 600 billion "users" of the web.

How do we keep all those agents safe when they touch the browser?

At PixieBrix, we've spent years protecting BPO contact centers from insider risk, fraud, and social engineering in the browser.

Today, we're applying that defense to AI agents and making a free, source-available, browser extension available (on GitHub and ClawHub).

Your AI agent that lands on a fresh page is one prompt injection away from leaking credentials, one dark pattern away from buying the wrong thing, and one fake review away from a bad recommendation.

Agent Browser Shield sits between the browser and the agent. It blocks:

Prompt injection: visible or hidden instructions in page content
Dark patterns: manipulative UI designed to trick/coerce
Context pollution: low-value context that impairs instruction following

A useful side effect: stripping irrelevant content also cuts token burn.

Come join us on our mission. File issues, send PRs, or just tell me what you hate/love!

The threat surface for agentic browsing is evolving fast. Let's defend our AI assistants together!

⭐ Star the GitHub repo: https://github.com/pixiebrix/agent-browser-shield
🦞 Star the OpenClaw skill: https://clawhub.ai/pixiebrix/agent-browser-shield

Did Google sneak a local LLM model into Chrome?

2026-05-26T00:00:00-04:00

There's a lot of FUD around Chrome's new Local AI models. Jason Calacanis on the All-in Podcast got it wrong: Chrome didn't sneak in a local LLM model; it was in their official Early Preview Program for months.

The local LLM shipped in 148 is their general Prompt API powered by Gemini Nano. Smaller, task-specific models for language detection, translation, and rewriting have been available since Chrome 138 (June 2025), a long time at AI pace!

Local LLMs distributed with the browser are critical to a future where users control their browsing experience while ensuring privacy. Consumers cannot be expected to figure out how to connect their web tools and extensions to Ollama or LM Studio. And enterprises cannot be expected to deploy local LLM servers to desktops.

There are still valid concerns about model lock-in. That's because AI models ( especially small models) can behave differently for the same prompt. But, from what I've seen, the Chrome team has been, by and large, responsible in how they've rolled out the technology. For example, the public API shipped in 148 does not expose model-specific parameters.

Local LLMs enable a range of productivity/compliance use cases, especially for regulated industries handling financial and health data. But since this is LinkedIn, here's a fun one instead: using PixieBrix + Local AI to customize your LinkedIn feed and hide self-promotional, snarky, or sarcastic posts. The question is -- will anything be left on my feed? 😆

The agentic opportunity: value, not hours

2025-10-26T00:00:00-04:00

A fundamental mistake people make when assessing the agentic opportunity is a focus on hours (or FTEs) instead of value.

It's indisputable that agentic automation will reshape the number of human hours for processes like order-to-cash and compliance.

However, it fails to address what drives enterprise value (vs. COGS). Defensible enterprise value comes from empowering your people to be their best.

At PixieBrix, we're focused on helping companies create customer success and loyalty to win.

Where agentic work creates value isn't always where it saves the most hours.

Co-pilots, not chatbots: highlights from a TaskUs Forward webinar

2024-09-02T00:00:00-04:00

I joined Manish Pandya (SVP of Digital at TaskUs) and host Alp Uguray (Masters of Automation) for a TaskUs Forward webinar on operationalizing generative AI in customer experience. A few moments from the conversation worth pulling out — the full transcript is here.

On AI looking like the early days of the internet

Todd: I think in a lot of ways AI looks like the early days of the internet. It's subsidized by an ample wave of investment from the venture capitalists. You have providers like Google, Amazon, and Facebook fighting to create this excess amount of infrastructure and capacity due to competitive pressure. We also see a very low barrier to entry to build prototypes. So ultimately I think AI is the future, but definitely not all the ideas and the companies and the headlines that you see are going to stick.

On human-driven AI

Manish: At TaskUs we believe in the power of human-driven AI, or human-in-the-loop, where the technology is amplifying the capabilities of the human as they deliver — not necessarily replacing them. This has potential to deliver empathetic, personalized, and nuanced responses that only a human can deliver, and not necessarily something that an AI can replicate, although AI can assist.

On chatbots vs. the natural flow of work

Todd: Chatbots are the fastest way to deliver AI to everyone at your company — and if you remember, ChatGPT was actually the fastest-growing consumer product of all time — but there's actually little consistency with outcomes when you just roll out a chatbot. […] What we're really seeing is companies figuring out how to embed AI into the natural flow of work, and as Manish said, it's really about making AI a true co-pilot for teammates.

On a true co-pilot, not just chatbots and search

Manish: What we're seeing is that clients are expecting the generative AI solutions to complement our teams so they can be freed up to perform high-value tasks. Essentially what they're looking for is a true co-pilot for our teams, not just chatbots and search.

On systems thinking and second-order effects

Todd: We've seen a lot of companies deploying, for example, customer-facing chatbots, and then running around with their deflection rate metrics saying, "hey, we did a great job," but then they see drops in their customer loyalty and lifetime customer value. So for me the key is to think holistically about your company and value chain — try to apply what a lot of people call systems thinking — and really try to understand what is unique about AI as a technology and therefore where it can best be applied.

On agentic AI and the next few quarters

Manish: Rather than talking about the next few years, let's talk about the next few months and next few quarters. […] You will also see that not just one-shot question and response with some follow-up queries, but being able to form a chain — which is what is called agentic AI — will emerge, where you provide a task and the generative AI solution is able to string together multiple automation capabilities together.

On building trust between humans and AI

Alp: We're introducing more automation to remove the mundane tasks that people hate to do, while bringing explainable AI — why AI does certain things and what the impact is, the transparency in execution. […] It's going to build a new trust between humans and AI. That trust is going to be really important and has its own requirements, and of course it has to bring business value — measuring the ROI where it needs to be, while we are driving meaningful work of the future.

The full webinar is on YouTube. A lightly edited transcript is on this site.

AI frees humans to be more human: highlights from Success League Radio

2023-09-19T00:00:00-04:00

I joined Kristen Hayer on Innovations in Leadership, the Success League Radio podcast, to talk through where generative AI fits in customer success. A few moments from the conversation worth pulling out — the full transcript is here.

On AI freeing humans to be more human

We think that AI frees humans to be more human. There are three areas. First, with AI you can automate a lot of the low-value activities… The second area is that AI can also be your personal trainer or coach… And then beyond that, there's the pure power to have AI upskill workers. It's a bit akin to that scene in The Matrix where Keanu plugs in, connects to the desk, and then suddenly downloads all the kung-fu knowledge.

On treating ChatGPT like an intern

The way I like to frame it is: let's say you were to hire an intern. What would you have them do? I say "intern" because interns require instruction. They're not experts in customer support. And they're not always perfect — sometimes you're going to have to check their work, or you might have to make some corrections.

On defusing hallucinations

Instead of saying "ChatGPT, go generate a response for me," what you instead do is you give it a list of things to choose from, or you give it some content and you say "summarize this content." When you're giving it those sorts of tasks, it's much better able to identify that it's only supposed to be using that as the source material, versus giving it all human knowledge and saying "what's relevant out of this entire space of human knowledge?"

On capabilities, not maturity

A maturity model is a model that looks at what sort of level of tools or processes you have in place — level one, two, three, or four. A capability model looks at specific capabilities and outcomes. When an agent picks up a ticket, do they have the context of prior interactions? Do we have alerting in place to make sure we're actually able to meet our SLAs about response times, even when someone's on vacation?

On the disclosure bright line

If it's fully automated, you should definitely be disclosing — not even just for ethical reasons, but for expectation-setting and maintaining trust with your customer. And then really, it's the assistant that becomes more of a gray area. We wouldn't disclose if I was using grammar check to write an email. I wouldn't necessarily disclose if I was using Google Translate to help translate a message to you. So that's kind of my bright line: if there is a human involved, I don't think you necessarily need to disclose. But if it's fully automated, it's probably both ethical and also just best practice to disclose there.

The full episode is on Spotify and Buzzsprout. A lightly edited transcript is on this site.

Compliance, low-code, and the user as hero: highlights from Drata's podcast

2023-03-09T00:00:00-05:00

I joined Helina Medhin and Arlo Guthrie (Drata's Director of Design) on Compliance Uncomplicated to talk about PixieBrix — how low-code can democratize software customization, where humans still beat computers, and why we went after SOC 2 early.

A few highlights from the episode:

On democratizing customization

You should be able to customize it to your needs, even if you aren't a programmer or a software developer.

On software as a representation of knowledge

[Software is] a representation of human knowledge about how the world works. When you build tools for analyzing software or creating software, you're actually deepening your understanding of the world and how to create things within that. And then, when you start running analyses or synthesizing, you're actually also creating new knowledge as you go.

On humans vs. computers (and AI)

Humans and computers have different strengths. Humans are very good at framing problems, navigating ambiguity, relationship building, whereas computers are good at rote memory, solving large computations. [...] [Computers are efficient at] rapidly synthesizing information from different sources to create new information. But they still need that interplay with humans to really drive outcome.

On user experience

Make the user the hero of the story. [...] To really empower them to be the hero of their own [story] — help themselves out and help their team members out.

On compliance

Compliance is about agreeing to do important things and then keeping your word. [...] [We wanted to be] communicating our compliance and controls in a way that our customers, and IT departments were already familiar with. [...] It's really about keeping our word, and then also communicating that in a way that's simple and makes sense to our customers.

The full episode is on Spotify and Amazon Music.

Everything is UI/UX: highlights from Masters of Automation

2022-08-09T00:00:00-04:00

I joined Alp Uguray on the Masters of Automation podcast to talk about why we started PixieBrix — what low-code/no-code really means, why the future of work has to be human-first, and what we'd been hearing from the community. A few moments from the conversation worth pulling out — the full transcript is here.

On the spreadsheet as the original citizen-development tool

The spreadsheet is the most successful citizen development tool of all time. In Microsoft Excel, you can start with static documents, you can add styling, you can add your text, and then you can start building out models with basic calculations. […] What people do in the financial world is they actually record macros, they write macros, they build out pretty much full-fledged applications in these spreadsheets that can run entire companies.

On everything being UI/UX

There's this joke that people throw around, that everything in life is sales. […] When it comes to computers, the same is true for UI/UX. Everything is about user interfaces. If you want to build a game, it's about the user interface. A productivity app — it's about the user interface. A smart device for your home — like, I have a smart thermostat — it's about the UI/UX.

On the future of work being human-first

At PixieBrix, we fundamentally believe that the future of work is human-first. It's about putting the human in the center of it. A lot of times when I hear people talk about future of work, they're coming at it from a view of a particular SaaS app, like a CRM, or a particular business process or process management platform […]. But what it really comes down to is that each person actually has multiple areas of responsibility. They're participants in multiple processes, multiple different functions in the business.

On not loving chat interfaces

I know a lot of people like using chat interfaces to AI, or other things. I actually can't stand that. I prefer to have a different sort of interface — clicking, seeing multiple options — instead of engaging in a conversation. It's really about being able to craft the perfect experience for yourself, regardless of what enabling technologies you're using under the hood.

On embracing imperfection because the human is in the loop

Because the human is in the loop, you don't need to be perfect. You don't need something that you write once and then it's going to go off and run on its own for two years, five years, ten years. You can really embrace that imperfection and really embrace that personalization, based on what that individual is, or what that business unit values, as part of the process.

On empowerment and the safety net

What's really interesting about empowering is, it's about giving those capabilities, but it's also about having a good safety net. Making it so that it's okay to make mistakes, it's okay to experiment. You're not accidentally sending out thousands of emails if you mess up a line of code, or you're not accidentally breaking compliance rules. […] It's about combining that sort of safety net with also those incredible creator tools, for people to really express themselves and experiment.

On low floor, high ceiling

We really try to make it so that there's a low floor to starting to use us, but a high ceiling to what's possible. And then really trying to create a welcoming community for people to get inspired, get help extremely quickly, and really showcase what they've created.

The full episode is on Spotify, Apple Podcasts, and the show's website. A lightly edited transcript is on this site.