Agent Browser: Google OAuth/GSI popups hang blank; Cloudflare blocks; coordinate click scaling mismatch

Support Bug Reports
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Agent Browser (cursor-ide-browser) cannot reliably complete Google GIS popup OAuth. Clicking Continue with Google opens glass-browser popup tabs that hang on Google GSI select/transform pages as blank/black screens with empty accessibility trees. After account selection it stalls on “One moment please…” and never completes the postMessage back to the opener, so the original site stays signed out.

Also: Cloudflare Turnstile/“Additional Verification Required” blocks Agent Browser; Google sign-in buttons live in inaccessible GSI button iframes; and browser_mouse_click_xy uses screenshot-image coordinates that do not match viewport/CDP coords (easy to miss the button until scale is reverse-engineered).

Steps to Reproduce

  1. Open Agent Browser to a site using Google GIS popup SSO (Indeed job-seeker auth is a good example).
  2. Ensure a Google session exists in the Agent Browser (Google Account page signed in).
  3. Click Continue with Google / Continue as user.
  4. Observe popup tabs open to Google GSI select or transform pages.
  5. Select the Google account if chooser appears.
  6. Observe hang on blank transform page / “One moment please…” and original site never receives the OAuth session.

Also for coordinate mismatch:

  1. On the auth page, locate the GSI button iframe via CDP getBoundingClientRect (example viewport center 247.5, 315).
  2. Pass those numbers to browser_mouse_click_xy.
  3. Click lands on the wrong element because the tool expects screenshot coords (in our capture ~1.81x scale; needed screenshot ~448,570 to hit viewport 247,315).

Expected Behavior

Google GIS popup OAuth should complete and return an authenticated session to the opener site. browser_mouse_click_xy coordinate space should be documented/consistent with viewport (or auto-convert). Google sign-in iframes should be targetable without reverse-engineering scale. Cloudflare blocks should surface a clear needs-human-verification path instead of silent failure or unexpected region bounce.

Operating System

Windows 10/11

Version Information

IDE:
Version: 3.15.1
OS: Windows_NT 10.0.26300 (Windows 10/11)
Component: cursor-ide-browser (Agent Browser / MCP browser tools)

For AI issues: which model did you use?

Agent Browser / Grok 4.5 (Agent mode)

Additional Information

Workarounds that worked:

  • Indeed: email one-time code login instead of Google GIS popup OAuth.
  • Full-page Google OAuth redirect (Cursor authenticator to Google account chooser) worked better than GIS popup mode.
  • For clicks: reverse-engineer screenshot to viewport scale before using browser_mouse_click_xy.

Also noted: background Task subagents cannot attach to the parent Agent Browser session (empty tab list / viewId not found), so browser work must stay in the owning agent turn.

Triage keywords: Agent Browser, MCP browser tools, Google OAuth GSI, Cloudflare Turnstile.

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

5

Hey, thanks for such a detailed report. I’ll break it down point by point.

Google GIS popup OAuth stuck on blank GSI pages or One moment please…
This is a known issue we’re tracking. OAuth in popup mode in Agent Browser currently doesn’t finish the handshake back to the original site. Your workarounds are exactly what we recommend today:

  • Sign in via email one time code instead of the Google GIS popup
  • Use a full page Google OAuth redirect instead of popup mode

I can’t share a timeline yet, but I’ll post in the thread when there’s an update.

Cloudflare Turnstile or Additional Verification Required
This is the site’s anti bot protection, not Cursor behavior. These checks are designed for a human to complete. The only fix is to take control in the browser and pass the check manually. I’ll pass along your request for a clear needs human verification signal as product feedback.

browser_mouse_click_xy coordinate mismatch
Great catch on the roughly 1,81x factor, that’s your devicePixelRatio. The parameter docs say viewport, but in practice the tool expects screenshot pixel coordinates, which is why clicks miss. I shared this with the team so the docs and behavior match. For now the only workaround is what you found: convert viewport coordinates into screenshot coordinates before calling it.

Subagent can’t attach to the parent browser session
This is expected right now. The browser session belongs to the agent that opened it, so background subagents can’t see it, which shows up as an empty tab list or viewId not found. Browser work needs to stay in the owning agent.

Let me know if the full page redirect doesn’t work on any specific site and we can look at it separately.