Autonomous AI agents face a fundamental problem when they need to access web services: authentication. Every SaaS console, API dashboard, and cloud provider portal protects itself with Google OAuth, multi-factor authentication, passkeys, and bot mitigation. Headless browsers used by agents cannot navigate these flows without exposing credentials, typing passwords, or handling one-time prompts. A new open-source tool called Lightpanda Session Bridge solves this by transferring real browser sessions into a headless runtime in a single click, with zero credentials typed and zero secrets exposed to language models.

The tool, built by Raknaos and Nous Research under the MIT license, captures authenticated session cookies from a desktop browser and injects them into a Lightpanda headless instance via the Chrome DevTools Protocol. The agent operates autonomously on the real authenticated session at the speed and memory efficiency of Lightpanda's Zig and V8 kernel, while the human never shares a password or API key.

Why agent authentication is broken

The conventional approach to giving AI agents web access involves either hardcoding credentials, using environment variables, or asking the human to authenticate on behalf of the agent. All three create security risks. Credentials in environment variables leak through logs, chat histories, and debugging output. Passwords typed by humans on behalf of agents create a dependency on manual intervention that defeats the purpose of autonomy. And headless browsers that attempt to solve CAPTCHAs or bypass bot detection run afoul of service terms and create brittle integrations that break when services change their defenses.

Lightpanda Session Bridge takes the opposite approach. The human authenticates once in their normal desktop browser, using whatever method the service requires: Google OAuth, a passkey, a TOTP code, or a hardware key. The Bridge extension captures the resulting session cookies and local storage, validates and normalizes them, and transfers them to a running Lightpanda instance. From that point, the agent has the same authenticated access the human had, without ever seeing the credentials.

The session is real. It is not a proxy, a shared token, or a forwarded cookie jar. The agent operates on the same session the human established, with the same cookies and the same authentication state. When the session expires or the human logs out, the agent loses access automatically.

How the bridge works

The architecture has three components: a Chrome extension, a Python relay server, and the Lightpanda headless browser. The extension runs in Manifest V3 and captures session data from the active browser. The relay server validates origins, normalizes cookie attributes, and translates CDP enums. Lightpanda receives the validated session over a WebSocket connection.

The flow starts with the human authenticating to a target service in their desktop browser. Clicking the Bridge extension icon sends an encrypted JSON payload to the relay server running on localhost. The relay performs origin and domain validation, then normalizes cookie attributes to comply with RFC 6265bis. Domain-locked cookies get their attributes adjusted to guarantee zero rejection by Lightpanda's CDP parser. The relay also translates Chromium's lowercase sameSite strings, like no_restriction and lax, into the PascalCase enum tags that CDP expects, preventing the InvalidEnumTag errors that break naive cookie injection.

The relay passes the normalized session to Lightpanda over a CDP WebSocket connection. The headless browser now has the authenticated session. An agent connects to Lightpanda through the Python SDK and begins interacting with the page as if it were the human user.

The extension pairs with the relay automatically on first use. When the popup opens, it fetches a shared secret from the relay's /v1/bootstrap endpoint and stores it in isolated storage. No manual token copy is required. The bootstrap endpoint rejects any caller without a real chrome-extension:// origin, so web pages, curl, and other local processes cannot obtain the shared secret.

Security constraints

The bridge enforces strict origin scoping. Loopback addresses, private networks, and identity provider root domains like accounts.google.com, login.microsoftonline.com, auth0.com, and github.com are permanently blocked from transfer. Only target SaaS domains such as api.com, mail.google.com, and console.cloud.google.com are admitted. This prevents the bridge from leaking session cookies to the wrong services.

No passwords, refresh tokens, or API keys are ever stored in disk logs or transmitted in chat histories. The relay server handles all cookie processing in memory. The session data moves over localhost WebSocket connections, never leaving the machine. The tool does not add stealth code, CAPTCHA bypass, or any mechanism to circumvent service protections beyond what a normal browser session already provides.

The unit test suite covers private IP rejection, identity provider blocking, and CDP envelope validation. Running python -m unittest discover -s tests -v or python relay/server.py --self-test exercises the security boundaries before deployment.

Using the session from Python

Once a session is synchronized, agents interact with the authenticated page through the Python SDK:

from lightpanda_client import LightpandaClient

client = LightpandaClient(cdp_ws="ws://127.0.0.1:9222/")
client.connect()
client.attach_or_create("https://api.com/console/log")

stats = client.evaluate("""(async () => {
    let res = await fetch('/api/user/self');
    return await res.json();
})()""")
print(f"Logged in user: {stats['data']['username']}")
client.close()

The agent evaluates JavaScript directly in the authenticated context. It can read data, submit forms, click buttons, and navigate pages. The session persists as long as the cookies remain valid. When the session expires, the agent receives an error and can prompt the human to re-authenticate.

The Python SDK wraps the CDP WebSocket connection and provides methods for attaching to existing sessions, evaluating scripts, and navigating. The agent does not need to manage cookies directly. The bridge handles all cookie injection and normalization before the agent connects.

Performance and memory

Lightpanda claims 9x the speed of Chrome with 16x less memory usage for headless browsing workloads. For agents that run many concurrent sessions or operate on resource-constrained infrastructure, these numbers matter. The headless browser runs in WSL2 on Windows or natively on Linux, listening on the loopback interface at port 9222.

The bridge is designed for autonomous operation. Once the session is synchronized, the agent runs without further human intervention until the session expires. The human can close the desktop browser without affecting the headless session. The cookies and local storage persist in Lightpanda's memory until they are explicitly cleared or expire naturally.

For teams building browser-using AI agents, the practical impact is straightforward. Authentication, the hardest part of giving agents web access, becomes a one-time human action. The agent gets a real session with real cookies, not a synthetic one. And the security model keeps credentials off the wire, out of logs, and away from language models that might otherwise memorize and reproduce them.

Lightpanda Session Bridge is available on GitHub under the MIT license. The repository includes the Chrome extension, Python relay server, SDK, and test suite. Upstream development of the Lightpanda browser engine continues separately at lightpanda.io. The project is a proof that agent authentication does not require agents to handle credentials at all, and that the gap between human and machine web access can be closed without compromising security.