Skip to main content
The model is told only the secret names. It types a value with type_secret('password') (or type_secret('password', id) for a specific input); secret_names() lists the names. The 0.x placeholders are not replaced: a cell that sends <secret>password</secret> or <secret:password> to the page raises an error naming type_secret('password'), and nothing is typed.

​
Formats

A port in the pattern must match; without one, any port does. The check uses the URL of the frame that receives the keys, as the browser reports it (not page JavaScript), followed into iframes and shadow roots. If that frame can’t be established, a domain-scoped secret is not typed. 2FA codes: a secret whose name ends in bu_2fa_code holds a TOTP seed. type_secret types the current 6-digit code, never the seed. Values under 4 characters log a warning: they are redacted only where they stand alone, not inside longer words or numbers.

​
What is redacted

Values become <secret:name> in the places below. That covers the value as typed and its common encodings: JSON-, repr()- and HTML-escaped, lower- and upper-case, reversed, base64 (also inside a longer base64 string, such as a Basic auth header), hex and URL-encoded. Redacted in:
  • what each Python cell returns to the model, and the cell output files
  • files written by checkpoint(), and result.partial
  • results and retry messages of your own tools
  • the task, follow-up tasks and extend_system_message, before the model sees them
  • result.final_result(), result.output, result.structured_output, result.error
  • result.messages, including retry messages that quote the model’s output back
Nothing else is redacted.

​
Trust model

This is not a sandbox:
  • The values live in the REPL worker process, so code the model writes can read them. A file that code writes itself is not redacted.
  • Screenshots are not redacted. A typed value in a visible field reaches the model as an image, and js() can read a field’s value back.
  • A cloud live view, or anyone with its URL, sees what is typed.
  • The worker gets an allowlisted environment (for example PATH, HOME, locale, temp dirs, BU_* / BH_*, HTTP_PROXY / HTTPS_PROXY / ALL_PROXY and CA bundle paths), minus any variable whose name contains KEY, TOKEN, SECRET, PASSW, CREDENTIAL or AUTH. A proxy URL with a password in it does reach the worker. It can still read files your user can read and the environment of your other processes, including the one running the agent.
Run untrusted tasks in a container or VM. For logins you don’t want to type at all, use a cloud profile (Browser(cloud_profile_id=...)) or a Chrome profile copy (Browser('chrome', profile=...)). See Browsers.