Pup - the AI's own browser
Public Made by Adomby adom
pup gives your AI a real browser on your desktop that it drives completely, in the background, signed in as you: windows that never jump in front of your work, one shared profile that learns your logins, and every window labeled on the taskbar with its AI thread's name.
pup_login on americanexpress.com: submit clicked the password Show toggle (password exposed), and filled values are not seen by the page
pup-bridge 2.0.738 · Windows 11 (adom_drew2) · site: https://www.americanexpress.com/en-us/account/login · 2026-10-27
1. pup_login {submit:true} clicked the password "Show" toggle, not Log In (security)
After the vault login was filled, pup_login {"submit":true,"submitReason":"..."} returned ok:true, but the page never submitted. Amex's password field has a "Show"/"Hide" toggle button inside it, and pup's submit clicked that, so the password was then displayed in plain text. A pup_screenshot taken next to see what happened captured the user's password and sent it to the cloud container. The user has been told to change it.
Expected: the submit picks the form's type=submit button (here #loginSubmit, text "Log In") and never clicks a button inside or next to a password field. After any submit, if the password input is no longer type=password, set it back and warn in the response.
2. Values from the vault fill are not seen by the page
Clicking #loginSubmit straight after the auto-fill (pup_click, real click) sent the browser to Amex's "Create an Online Account" page (oce.americanexpress.com/...request_type=un_Register), twice, with no error. The inputs showed the right lengths (9 and 18) but the page's own state was evidently empty. What worked: pup_click each field, End, pup_type "x", Backspace, then pup_press_key Enter. So the fill sets .value without the input events this page listens for.
Expected: the fill types the way a person does (or fires the full keydown/input/change sequence), so a following submit is accepted.
0 Replies
Log in to reply.