AI-Powered Script Generation for Secure, Cross-Site Credential Rotation

Client: A leading password management platform

Stack: TypeScript, Anthropic Claude, Chrome DevTools Protocol (via MCP), Zod, Chrome Extension (browser automation)

The problem

Every Website Is Different

The client wanted to offer automated credential rotation as a product feature—when a site is breached, or a password is weak, rotate the user’s credentials. But “change your password” is a workflow that lives on someone else’s website, and every website implements it differently.

Password change flows are buried at varying depths in account settings, behind re-authentication gates, across multi-step confirmation screens, sometimes inside shadow DOM trees that standard browser APIs cannot reach. The login flow alone — a prerequisite for rotation — varies widely: federated identity, CAPTCHA, MFA prompts, and SPAs that rewrite the page without triggering navigation events.

You cannot hand-write automation scripts for every website on the internet. Even scripting the top hundred requires ongoing maintenance — a form that worked last month breaks when a team ships a new frontend framework or reorganizes their settings page. Selenium, Playwright, and RPA platforms are brittle precisely because they encode specific DOM structures. When those structures change, the scripts break, and a human has to rewrite.

The client needed to generate site-specific automation scripts at scale—reliably enough to ship as a product feature, but securely enough that the generation process posed no risk to user credentials.

They handed this to BiTE as an open investigation: can AI make this possible?

The Constraint

No AI in the Extension

One architectural constraint shaped every subsequent decision.

The client’s browser extension is a security product. Users trust it with every credential they own. The client determined early that running AI inference inside the production extension was inconsistent with their security posture — foundation models are nondeterministic, and a system that manages credentials cannot have a component that might behave unpredictably at runtime.

The AI could generate automation scripts, but could not be involved in executing them. The extension would only run deterministic, pre-validated scripts. Once a script was generated, validated, and tested, the AI was out of the loop entirely.

Many AI automation approaches keep the model in the execution path — observing the page and deciding what to do in real time. That’s flexible but unpredictable, and for a security product, unpredictability is a defect. The client wanted the AI’s intelligence captured in a static artifact that could be inspected, tested, versioned, and executed deterministically. The model reasons once; the extension executes many times.

Script Generation

An AI That Navigates, Not Guesses

The core of our work was a script-generation pipeline: a foundation model (Anthropic Claude) navigates target websites, traverses their authentication and password-change flows, and produces a portable, abstract script of those steps.

How the AI Sees the Page

Standard LLM-based automation approaches feed the model a page’s HTML and ask it to predict which elements to interact with. This works poorly — raw HTML is noisy, the model reasons about a static snapshot, and it cannot observe what happens after an interaction or follow SPA navigation.

We built a Model Context Protocol (MCP) server for Chrome DevTools that gives the AI live, bidirectional access to the browser. Instead of receiving an HTML dump, the model issues discrete tool calls — navigate to a URL, request a structured DOM snapshot, click an element, wait for navigation — and receives results after each action. The DOM snapshots are concise, hierarchical trees derived from accessibility information, with ephemeral identifiers that let the model reference specific elements across interactions.

This creates a closed loop. The AI navigates to a login page, inspects the DOM, identifies the username field, enters a value, observes the page response, locates the password field, submits, and follows the site’s next flow. If a SPA replaces the DOM without a navigation event, the AI requests a fresh snapshot and reorients. It reasons about a live environment, not a frozen document.

From Observation to Script

While the AI navigates the browser, we observe its actions and distill them into a clean automation script. Not every action the model takes is useful — it might click something exploratory, backtrack, or retry an approach. The distillation step strips noise and produces a minimal sequence of steps that reproduce the successful path.

Each step is a typed object in a schema we designed for this project — AutomationScript. Steps are abstract operations: navigate to a URL, click an element by selector, enter text into a field, wait for a page load, etc. The schema is deliberately constrained — it cannot express arbitrary JavaScript execution or free-form DOM manipulation, only operations the extension already knows how to perform. Every generated script is validated against Zod rules at generation time. If a script contains a malformed step or an operation outside the permitted set, it fails validation and is never used.

The Selector Problem

During generation, the AI locates elements using ephemeral identifiers issued by the MCP server — internal references that exist only during that browser session. But the output script needs to locate those same elements using public mechanisms that work across sessions: CSS selectors, element IDs, ARIA labels, data attributes.

A significant portion of the prompt engineering focused on the selector strategy. The prompts instruct the model to prefer stable identifiers—id attributes, ARIA labels, and data-testids — over positional selectors such as XPath or nth-child that break when a site adds an element. This preference hierarchy is a heuristic, not a guarantee. Some sites don’t use stable identifiers. Some place critical elements within shadow DOM trees that standard selectors cannot reach.

Reddit, for example, renders login form fields inside nested shadow DOM boundaries. Browser support for cross-shadow boundary queries remains limited and inconsistent. We could generate a working script for password rotation (which happens in an authenticated session with a more accessible DOM), but could not reliably script the login flow. These limits were identified during testing, not discovered in production.

The Test Harness

Rapid Validation Outside the Extension

Testing generated scripts against the full extension integration for every iteration would have been prohibitively slow — the extension has its own build process, state management, and credential handling. We built a separate test harness — itself a lightweight browser extension — purpose-built for script validation.

The harness executed scripts step by step, pausing at each action, showing the DOM state, and reporting exactly where a script failed. When a selector missed its target, the harness showed what it was looking for and what was actually present. When a navigation step timed out, the page state was shown at the time of failure.

The most common failure mode was not logic errors in the flow — the AI generally understood the authentication sequence correctly — but selector failures. An element might be inside a shadow DOM, matched ambiguously by the chosen selector, or dependent on a framework finishing its render. The harness let us diagnose these in minutes, refine prompt instructions, and re-generate.

We maintained a working set of roughly twenty high-traffic target sites — Microsoft, Apple, Google, Roblox, Asana, Twitter, and others — as ongoing validation targets. When a script worked, it reliably continued to work, with the expected volatility inherent to browser automation. When it didn’t, we knew during development.

Execution

Deterministic Replay in the Extension

The client’s existing extension provided a solid foundation for web page interaction, including well-tested capabilities for core password manager functions like filling fields, clicking elements, and reading page state. Our newly developed scripts seamlessly integrated with and leveraged this pre-existing infrastructure.

At execution time, the extension walks through a generated script step by step, translating each abstract operation into concrete browser actions using its existing automation code. When a step requires the user’s credentials, the extension hydrates it from the user’s vault: username, current password, and a newly generated password. The script itself contains none of this data, only typed placeholders the extension resolves at runtime from the user’s encrypted cipher.

This is the clean boundary the “no AI in the extension” constraint produced. The script is a static, validated, inspectable artifact. The extension is a deterministic executor. Credentials never enter the generation pipeline. The AI never sees user data. The extension never runs unpredictable code.

When execution fails — a selector misses, a page loads unexpectedly, a CAPTCHA appears — the extension handles it as it does any automation failure: it stops and informs the user. No retries with AI reasoning. No runtime adaptation. A clean failure, consistent with how the product already behaves.

Delivery Model

This project arrived as a question, not a specification: could AI generate browser automation scripts well enough to power a credential rotation feature? The client gave BiTE the autonomy to investigate from first principles.

We led the exploration end-to-end — feasibility research, MCP server architecture, schema design, test harness development, prompt engineering, iterative refinement against real target sites, and integration with the client’s extension platform. Throughout, we operated embedded within the client’s organization: producing documentation, presenting architectural decisions to leadership, incorporating feedback, and working within their security constraints.

The result was a validated answer to the original question: yes, AI-generated scripts can handle the variation across sites well enough to pilot, and here is an architecture that does it without compromising the security properties the product depends on.

What This Demonstrates

The core design problem was to place AI reasoning at the appropriate boundary—during script generation— to explicitly exclude it from credential handling and script execution. The architecture enforces this separation structurally, not by convention.

The generation pipeline required deep integration between the foundation model and the browser, careful attention to durable element selection, and distillation of model actions into minimal, schema-validated scripts. The prompt engineering was substantial — not clever phrasing, but a structured instruction set that produces reliable output across wildly different target sites.

The client handed BiTE an open-ended investigation and received a working system, a tested architecture, a validated set of target sites, and clear documentation of where the approach hits its limits. We did not oversell the results or paper over the edges. The client got an honest assessment of what AI-powered credential rotation can do today, built on an architecture they trust enough to integrate into a security product.