The report
Cloudflare has added a persistent browserTool to Agents SDK v0.28.0. An agent can return to earlier tabs and keep its login state while its Browser Run session remains alive, including across Durable Object hibernation. Each conversation receives its own active tab, but Cloudflare explicitly says cookies and logins are shared throughout the browser instance.
That design reduces repeated sign-in friction and adds an authority boundary for applications serving multiple accounts. A conversation-specific tab is not an isolated cookie jar. A developer must ensure the browser lifecycle and user/session allocation do not allow one user's delegated browsing privileges to be reused for another's task. This is a documented architectural risk to test, not a proven cross-tenant breach.
Cloudflare documents a default 10-minute idle timeout. On restart or crash, old tabs and login state are cleared and the tool reports restarted: true.
Persisted authentication makes the distinction between browsing and granting authority important. The separate browser-agent consent experiment shows why a page instruction cannot authorize a logged-in agent to change permissions. This is a comparison of risk boundaries, not a reported Cloudflare compromise.
Which state belongs to the user?
A tab is a navigation container, while a cookie jar carries authentication. Cloudflare's documented shared-login behavior means those two objects do not map one-to-one. For a single user's long-running assistant, persistence may be the intended feature. In a service with distinct user principals, the application must instead demonstrate that browser instances and their credentials cannot be handed across principals, even when Durable Objects resume and old tabs are reused. A default idle timeout is a cleanup policy, not proof of per-user isolation.
This creates two distinct audit questions: whether the browser was allocated to the correct principal, and whether the actions performed with its stored session were independently permitted. The controlled consent-attack research addresses the second question under a simulated service. It does not document a defect in Cloudflare's new browser feature.