Browser Agent Firewall: selling tools

Evidence for Browser Agent Firewall: 1. Evidence pack · 2. Answers to buyer questions · 3. Figures & benchmarks · 4. Selling tools · IHVRK kit · Learn it

The evidence is your best sales tool: a buyer can check it without trusting you. Press Copy on any box, fill in the [brackets] and send it, one person at a time.

What to send, and when

When	Send this
First message	A short personal note with the kit page
They reply, "show me"	The live demo on a call, using the script below
"Send it to our engineer"	The kit and the evidence pack
Security review or questionnaire	The answers page. Never upgrade a NO to a YES.
Finance or procurement wants records	The figures page and figures.tsv
Ready to go ahead	The hand-off below. The founder does the contract, price and setup.

Who to approach

Head of IT / security: Staff using AI browsers with company logins.
Founder of a browser-agent product: Customers fear account takeover.

Questions to ask them

Which AI browsers or agents do you use?
What are they logged into?
Who approved them?
What would a hijack reach?

30-second pitch

Browser Agent Firewall stops an AI browser from doing what a web page secretly told it to, while still doing what the person asked.

We recorded 6 live checks, including 5 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.

Don't trust us. Check it: https://cainstudio.online/ihvrk-browser-agent-firewall.html

First email

Subject: what a web page can make your AI browser do

Hi [first name],

AI browsers act with your logins, and a web page can hide instructions for them. In 2025
researchers showed hidden comments making AI browsers read email and leak sign-in codes. Browser Agent
Firewall checks every action against the task and stops the hijacked ones.

Live demo: https://cainstudio.online/guide-browser-agent-firewall-lab.html

The evidence: We recorded 6 live checks, including 5 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Check it yourself: https://cainstudio.online/ihvrk-browser-agent-firewall.html

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

LinkedIn connection note (under 300 characters)

Hi [name], we stop AI browsers from following instructions hidden in web pages, while still finishing the task. Happy to show it live.

One follow-up, three days later (then stop)

Hi [first name], the hidden-comment demo takes 30 seconds: https://cainstudio.online/guide-browser-agent-firewall-lab.html

Live demo call script

1. Show the normal case
   Do: Open https://cainstudio.online/guide-browser-agent-firewall-lab.html and run: Control: the task the person actually asked for
   Say: Search, read, follow a link and submit a form on the site the task covers. Everything must be allowed.

2. Now the attack
   Do: Run: A hidden Reddit comment tries to steal a sign-in code
   Say: Modeled on a 2025 disclosure about an AI browser: a comment tells it to read the mailbox and post the code.

3. Now the attack
   Do: Run: A phishing page asks for the bank password
   Say: The saved login belongs to the real bank's address, so it cannot be typed into a look-alike page.

4. Let them check you
   Do: Send the kit link and ask them to run python3 verify.py --live on their own computer.
   Say: They don't have to take your word for any of this. That's the point.

5. Say the limit yourself
   Do: It checks the actions it is shown. A browser that does not ask it is not protected.
   Say: Say it before they ask. It costs nothing and it earns trust.

When they push back

The browser maker handles this.

Their safeguards are inside the AI, which reads the attacker's text. We check the action itself.

Will it break normal browsing?

The control session in the demo is fully allowed; that is the point of checking against the task.

Does it work with our browser?

The browser or agent has to ask it before acting; we set that up in the pilot.

Why should I believe your numbers?

You shouldn't have to. Run the kit on your own computer: https://cainstudio.online/ihvrk-browser-agent-firewall.html. It re-sends every request and compares the answers, using no code of ours.

What doesn't it do?

Written down here: https://cainstudio.online/guide-browser-agent-firewall-limits.html

Are you SOC 2 or ISO certified?

No, we hold no certification. What we offer instead is evidence you can check yourself.

Has anyone independent tested it?

No third-party audit has been completed. The attack cases in the kit are our own. I'd rather tell you that now.

Who else uses it?

We are an early company. I can show you the product working and the evidence, not a customer list.

It found nothing. So we're safe?

No. It means none of its checks fired. It doesn't prove something is safe.

How much is it?

Sell Browser Agent Firewall as the $500 30-day pilot.

One-page summary (paste into a document or email)

Browser Agent Firewall
by FIRME AI CORPORATION, a California corporation

What it does
Browser Agent Firewall stops an AI browser from doing what a web page secretly told it to, while still doing what the person asked.

The evidence
We recorded 6 live checks, including 5 attack cases it had to refuse or flag, and every one matched. You can re-run them yourself without an account.
Recorded 2026-11-03. 6 live checks. Median round trip 47 ms including network; this is not a load test or an SLA.

Check it yourself
https://cainstudio.online/ihvrk-browser-agent-firewall.html
Zip SHA-256: 4ab75aefcac615f6c78bf9050fd6c065b9c78db66cc834ddb20ebedb31be3c83
Signing key fingerprint: 1cacdfc1fc2024b6bb4f8fb02c7c80f4a57f44c5adb11c507190781b5d613de3
Run: python3 verify.py --live  (Python 3, no account, no code of ours)

What it does not do
Written down here: https://cainstudio.online/guide-browser-agent-firewall-limits.html

What this is not
Not a third-party audit, a certification or a guarantee. No SOC 2 or ISO certification is held.

Contact
[your name], working with FIRME AI CORPORATION, [your email]

After the call: the proposal email

Hi [first name],

Thanks for your time. As discussed, here is what I suggest for Browser Agent Firewall.

What you told me: [their problem, in their words]

What we'd do: Sell Browser Agent Firewall as the $500 30-day pilot.

Evidence you can check before deciding: https://cainstudio.online/ihvrk-browser-agent-firewall.html
Answers for your security review: https://cainstudio.online/evidence-browser-agent-firewall-answers.html
Figures for your files: https://cainstudio.online/evidence-browser-agent-firewall-figures.html
Limits: Written down here: https://cainstudio.online/guide-browser-agent-firewall-limits.html

Next step: [date], [who]. The founder, Vincent Noriega, handles contract and setup.

[your name], working with FIRME AI CORPORATION
[your postal address]
If you'd rather not hear from me again, just say so and I won't write again.

Hand-off to the founder

To: vincent@firmeai.com
Subject: Lead: Browser Agent Firewall - [company]

Company: [company]
Person: [name], [job title], [email]
What they said: [paste their reply]
Evidence already sent: https://cainstudio.online/ihvrk-browser-agent-firewall.html
Price mentioned: [what you quoted, or none]
Next date: [date]

The rules

Send each message yourself, one person at a time. No bulk lists and no automated sending.
Commercial email needs your real name, a real postal address and a way to opt out, and you stop when someone asks (US CAN-SPAM; many countries are stricter, so check yours).
Never change a number, invent a customer, or say certified, audited or guaranteed.
Only test a system the client owns or operates, after they confirm it in writing.
Your share is agreed in writing with FIRME AI CORPORATION before your first message (email vincent@firmeai.com). Nothing here promises income. Most messages get no reply; that is normal.