A developer switches browser tools to auto-run so a long UI regression run stops interrupting them for approvals. With that still set, they ask the agent to go and read an unfamiliar third-party vendor's site and gather integration details. Why is the second task the one that should worry them?

The principle — Auto-run means all browser actions execute immediately without approval, and the documentation is unambiguous about where that must not be pointed: never use auto-run mode with untrusted code or unfamiliar websites, because Agent could execute malicious scripts or submit sensitive data without your knowledge. The variable that decides the risk is how much you trust the target, not how much you care about it.

Why the key is correct — Under manual or allow-listed approval, a person sees each navigation, click, type and submission before it happens, and that review is the whole protection. Auto-run removes it. On your own development server that costs little, because you already trust everything the agent can reach. Pointed at a site nobody on the team has vetted, the same setting means page content can lead the agent to click through flows, trigger scripts and enter data into forms with no moment at which anyone could say no. Changing tasks without changing the setting is the actual error in this scenario.

Why the others are wrong — Reading auto-run as pure convenience misses that the prompts it removes are the review; and importance is the wrong axis, since a hostile page is unimportant and dangerous simultaneously. Expecting the browser's isolation to contain the damage confuses two different protections: token authentication and per-tab isolation stop others from hijacking the browser session, and neither prevents the agent itself from submitting your data to a page that asked for it. Counting actions rather than weighing trust reaches the wrong conclusion for the same reason — a thousand trusted actions are safer than one untrusted one.

Remember this — Make the approval mode part of the task, not part of your setup. Auto-run belongs to local work against code and servers you own; before the agent touches a site you have not vetted, put approvals back and review the auto-approved actions you have accumulated while you are there.

Sources — Cursor's Browser tool documentation.