From a project workspace agent chat (e.g. jsolly-website), browser_tabs / browser automation can list and control Browser Tab(s) that belong to the Home / empty-window workspace. Observed viewId like stable-browser-session/b23abea01bc4771017b008369920af3f where b23abe… is the empty-window workspace id, while agent cwd/project is a different workspace. CDP/browser_snapshot sometimes hit a different Glass forum tab than the one being filled; forum session briefly showed logged-out while another tab was still authenticated.
Steps to Reproduce
Keep Home/empty-window open with Browser Tab activity (or prior Glass tabs)
Open a different project workspace agent chat with Browser Automation = Browser Tab
Agent: browser_tabs list
Observe tabs/viewIds that embed the Home/empty-window workspace id
Agent navigate/fill on those tabs — actions affect the other workspace’s browser, not a project-local tab
Expected Behavior
Agent browser MCP should only see/control Browser Tabs for the current workspace (or clearly scoped session). It must not attach across Cursor windows/workspaces via a shared stable-browser-session id.
Operating System
MacOS
Version Information
IDE:
Version: 3.13.21
Commit: 55434bd8062ece6fee083b82beed2aee42d253f0
OS: Darwin arm64 25.5.0
Brave is system browser.
For AI issues: which model did you use?
Cursor Grok 4.5
For AI issues: add Request ID with privacy disabled
N/A — failure is MCP routing / Browser Automation wiring, not a model completion error.
Data sharing on. Strongest log evidence for cross-workspace browser / MCP FS bleed.
Cross-workspace signals
From a project agent chat, browser viewId was stable-browser-session/b23abea01bc4771017b008369920af3f — that hex is the Home/empty-window workspaceId, not the project’s.
Project MCP FileSystem Writer (workspaceId=c63b395f862a583cf684909c2973e535) hit: ENOENT … open '/Users/johnsolly/.cursor/projects/Users-johnsolly-cursor-worktrees-stocktextalerts-sfeo/mcps/cursor-ide-browser~staging/tools/browser_click.json'
i.e. tried to write cursor-ide-browser staging tools into a third project’s path (stocktextalerts worktree) while this chat was on jsolly-website.
Session / identity (data sharing on)
machineId:45f9fb3f-e7a9-4793-a235-3a7bb93e4e3f
Cursor: 3.13.21 (55434bd8062ece6fee083b82beed2aee42d253f0) Darwin arm64
The in-app Browser Tab surface is currently window-scoped, not workspace-scoped. Every agent chat hosted inside a single Agents Window shares one browser view store and one shared “stable” browser tab, and that shared tab’s ownership is re-stamped to whichever agent is currently active - so a project chat can end up listing and controlling a tab that the Home / empty-window chat was last using. The stable-browser-session/<hex> id you saw is that per-window shared tab, keyed off the window’s original root workspace (Home in your case). This is something we’ve seen reported before, and I’ve logged your external report as an additional data point with our team.
Workarounds while this gets addressed:
Keep sensitive / authenticated sessions out of the in-app Browser Tab when you plan to run browser automation from a different project’s chat in the same Agents Window. Use an external browser for authenticated flows, or close the shared Browser Tab before switching contexts.
When your agent uses browser automation, always list first and pass an explicit viewId. Have the agent call browser_tabs list, pick the exact tab it means to touch by viewId, and then pass that viewId (with browser_lock) into every subsequent browser_click / browser_type / browser_navigate / browser_snapshot call. That eliminates the “snapshot hit a different tab” class of accidents where the tool falls back to lastInteractedTab → activeTab → tabs[0].
If you specifically need isolation, opening each project in its own Agents Window (a fully separate Cursor window, not another chat inside the same window) also side-steps this - different windows have separate browser stores.
For the MCP filesystem writer anomaly you flagged in your other posts (the cursor-ide-browser~staging tools getting written into a third project’s mcps/… folder), that’s a separate signal - worth keeping under those other topics of yours so the two don’t get conflated. I’ll follow up there separately.