Leave a Browser Agent Running While You Step Away: Screen On, Keyboard and Trackpad Locked

The agents have moved into the browser. Claude in Chrome, the agent modes in ChatGPT and in browsers such as Perplexity’s Comet, and a growing set of extensions will now open tabs, fill forms, read pages and click through a twenty-step task while you watch. And watching is the problem: unlike a terminal job, a browser agent is working inside the same window you use for your email, your bank and your logged-in admin panels, in a signed-in session that anyone at your keyboard can also use. Walking away from it for coffee is a different proposition from walking away from a build.

This post is about doing that safely: leaving a browser agent visibly running on a Mac while you step away, with the screen on so you can see what it is doing from across the room, and the keyboard, trackpad and every other app locked so nobody else can. It is the browser-shaped version of our guide to leaving Claude Code running while away, with the parts that are different called out honestly, including the one case where a keyboard lock interferes with the agent itself.

Why a browser agent is riskier to leave than a terminal

• It runs in your identity. The agent uses your cookies and sessions. Whatever it can reach, a passer-by can reach through the same tabs with one click.
• It needs the window visible. Many browser agents act on the rendered page and pause or misbehave if the tab is hidden, the display sleeps or the window is covered. So the usual answer, the macOS lock screen, is exactly wrong: it blanks the display.
• It asks questions. Agents stop for approval before a purchase, a form submit or a login. A stopped agent on an unlocked Mac is an open browser waiting for anyone to click “Allow”.
• It is interesting to watch. A screen that is doing something draws people over. In a shared office or a café that is an audience you did not invite.

What you want: visible, awake, untouchable

The target state is simple to say. The browser stays on screen and the display stays awake, so the agent keeps working and you can glance at it. Every keystroke, click, scroll and trackpad gesture is ignored, so nobody can approve, type, switch tabs or open your mail. Everything else on the Mac is hidden. Getting back in takes Touch ID or your login password. That is what VibeLock does: it keeps the apps you choose visible, blocks all input system-wide, hides every other app behind an opaque backdrop, holds a no-display-sleep assertion so the screen stays on, and unlocks with Touch ID or your Mac password checked locally. It is $10 once and runs on macOS 13 or later.

Setting it up for a browser agent

1. Add the browser to Visible While Locked. VibeLock pre-allows terminals, the Claude desktop app, ChatGPT and VS Code, but not browsers, because a visible browser is usually the thing you want hidden. For this use you want it shown: from the menu bar icon, open Visible While Locked and tick Chrome, or whichever browser the agent lives in. Visible means watch-only; input aimed at it is still blocked.
2. Leave Accessible While Locked empty. This list lets an app be used while locked. An accessible browser is an unlocked browser. Keep it empty; the baseline is the safe one.
3. Close or sign out of what the agent does not need. VibeLock hides other apps, but it cannot hide the other tabs in the same browser window: by design, anyone can read what your visible apps show. Close the banking tab. Better, give the agent its own browser window or profile with only the tabs it needs, and lock with that window frontmost.
4. Turn on a Focus mode. Notification banners are drawn by macOS, not by hidden apps, so previews can still appear over the locked screen. Do Not Disturb before you lock.
5. Start the task, then lock. Give the agent its instructions, confirm it has started, then click the menu bar icon and Lock. Grant Accessibility access the first time; it is the only permission VibeLock needs.
6. Come back with a key or a click. Any key or click raises the unlock shield; Touch ID unlocks instantly, or type your Mac login password. Everything returns exactly as you left it, including the agent mid-task.

The important caveat: will the lock block the agent?

VibeLock works by installing a session-wide event tap that swallows keyboard, mouse and scroll events before any app sees them. That raises an obvious question for an agent that clicks and types. The answer depends on how the agent drives the browser, and you should test it once before relying on it.

• Agents that act inside the browser, through an extension or the browser’s own automation interface, inject their clicks and keystrokes into the page from within the browser process. Those never travel through the macOS input stream that VibeLock taps, so a lock does not interfere with them. This is how Claude in Chrome and most extension-based agents operate.
• Agents that act like a user, posting synthetic macOS mouse and keyboard events to drive any application on screen (the computer-use style), are indistinguishable from a person at the keyboard to an event tap, and a lock would swallow their input too. For those, lock only while the agent is in a phase that needs no input, or do not use an input lock at all.

The one-minute test: start a harmless multi-step task, lock, and watch whether the agent keeps clicking. If it does, you are in the first category. If it stalls, unlock, and treat the agent as a reason to use the plain macOS lock screen and a different monitoring approach instead.

What a locked browser agent looks like from across the room

This is the part terminal users already know and browser users are about to discover. With the display held awake and the browser visible, you can see from the kitchen whether the agent is still stepping through pages or has stopped on an approval dialog. The cursor still moves if someone nudges the trackpad, but clicks do nothing, so a colleague leaning over to look cannot accidentally approve a purchase or close the tab. And because ⌘Q, Spotlight and Force Quit are blocked system-wide, nobody can quit the browser and end the run, however helpful they are trying to be.

When the agent stops for a question, you do what you would do for a terminal prompt: walk back, unlock with Touch ID, answer, lock again if the task continues. If a trusted colleague needs to answer in your absence, the accessible-app approach works for a desktop agent app, but for a browser we would not recommend it: making the browser accessible hands over every tab.

What VibeLock does not protect

Being clear about the limits is the point of a security tool. VibeLock is for the ten-minutes-away case against casual misuse, not against a determined attacker with time or tools.

• The screen itself. Anyone can read what the visible browser shows, including a page with personal data on it. Only leave visible what you would show a stranger.
• Trackpad Space swipes and Mission Control gestures cannot be blocked by an event tap; VibeLock covers any Space showing a hidden app with its shield, so the mitigation holds, but the gesture itself still happens.
• The power button and the lid. A press or a lid close ends up at the real macOS login screen, which protects your data but also ends the display the agent was using.
• Remote access. Anyone who can SSH to the Mac can end the lock; that is also the documented emergency escape.
• Other software with automation permissions keeps running with your privileges. VibeLock does not police it, and that includes the agent itself: lock or no lock, the agent will do what you told it to, so the instructions you leave it with matter more than the lock.

When to use the real lock screen instead

If the agent’s task does not need the display, if you will be gone for hours, if the place is one you do not trust, or if the pages it will visit contain anything you would not want read, press ⌃⌘Q and use the macOS lock screen. Some browser agents keep working behind it and some do not, which you can also find out with the one-minute test. VibeLock is for the specific case this post is about: a task you want to keep watching, in a browser you want nobody else to touch.