Approve, Don't Disclose: Phone-Anchored Credential Release for Browser-Using AI Agents

AI agents that operate a web browser on a user's behalf routinely stall at login pages. The usual workarounds each have a cost. Pasting the password into the conversation or storing it where the agent can read it exposes the secret to a component that prompt injection can steer. Handing the session back to a human defeats the purpose of automation. We present the azena Login Bridge, a system in which an agent can request a login but never handles the credential, even under the assumption that the agent itself is compromised. The request travels from a code-signed macOS helper through an untrusted relay to the user's iPhone. The phone shows a screenshot of the real login page together with the origin taken from the browser, and the user approves with Face ID. The phone then releases the credential, encrypted with HPKE to a single-use key that exists only inside the Mac's Secure Enclave. A Chrome extension types a random placeholder into the page and substitutes the real secret only in the outgoing HTTP request body, below the page and out of reach of page scripts and of the agent. The agent learns a single status word. We give the threat model, the protocol with message-level figures, an informal security analysis, the placeholder-substitution rules hardened by adversarial testing, measurements of the deployed implementation (iOS, macOS, Chrome, Cloudflare Workers), and the findings of an independent pre-release review. A second stage adds a FIDO2 hardware key (YubiKey) for the rare, high-impact operations of pairing, enrolment and recovery. It removes the remaining trust in the Mac's screen during pairing and enables an encrypted vault backup that only the physical key can open.