signal insight

Cloudflare adds hostname guardrails to control where Browser Run agent sessions c…

On September 14, 2026, Cloudflare added guardrails to Browser Run (Browser Rendering) that limit which hostnames a browser session's HTTP/HTTPS requests can reach, giving teams a way to constrain where automated and agent-driven browser sessions navigate.

Published Sep 14, 2026 Updated Sep 16, 2026 1 sources

CloudflareCloudflare Browser Renderingsecuritysecurity changemedium impact

securityagentsenterprise-controlssecurity change

Impact: medium
Confidence: 82%
Change type: security change
First seen: Sep 14, 2026
Last updated: Sep 16, 2026
Audience: platform engineerssecurity teams
Status: Ready

Summary

What changed

Browser Run guardrails now let developers restrict the HTTP/HTTPS hostnames a browser session can access, bounding outbound navigation from headless browser sessions.

Why it matters

Headless browsers are a common execution surface for AI agents that browse, scrape, or act on the web, and an unconstrained session is an exfiltration and prompt-injection risk. Hostname allowlisting turns Browser Run into a safer sandbox for agentic web tasks.

Evidence excerpt

Guardrails now limit browser sessions' HTTP/HTTPS requests to permitted hostnames for enhanced security controls.

Sources

developers.cloudflare.com