Apple built the hook that lets your coding agent drive Safari
Safari 27.0 shipped on 17th Sep'26 with an MCP server built into safaridriver, Safari's own remote automation driver, behind a new --mcp flag. There is no extension and nothing to download; you tick two boxes in Safari's settings and point your agent at /usr/bin/safaridriver. WebKit's own documentation names Claude Code and Codex and supplies the command.
The server exposes sixteen tools covering tabs, navigation, page content as markdown or HTML, screenshots, console messages, network requests, clicking and typing, and running JavaScript inside the page. It runs locally and makes no network calls of its own, and Apple says it reaches no AutoFill data, browsing history or other personal Safari data. WebKit's caveat is one line: only use agents you trust.
What it actually means
Browser automation for agents has meant running Chromium in the background, which is a second browser with a separate profile and none of the sessions you are already signed into. This is your real browser with your real logins, so the setup disappears and the debugging loop closes, but the agent is now working inside a window where you are authenticated to things.
That is the same trust boundary as today's lead, arriving from the other direction. The pinned plugin was a control that quietly failed, while this is Apple being straight that there is no control beyond the checkbox, because evaluate_javascript runs whatever the agent decides inside a page you are signed into. The sensible move is a separate Safari profile for agent work rather than the window holding your admin sessions.
The agent gets your real browser, which means it gets whatever you are still signed into.
Source: Gear Live (reporting WebKit) · Saturday 19 September 2026