What an AI browser agent actually is
A browser agent is a model that drives a real web browser. It loads pages, reads them, clicks buttons, types into fields, switches tabs and submits forms — the way a member of staff would with a mouse and keyboard. There is no integration underneath: it works through the human interface because that is the only interface available.
It sees a page two ways: screenshots plus coordinates, or the accessibility tree — the structured list of headings, links, buttons and fields browsers already build for screen readers. Microsoft's Playwright MCP server uses the tree only, so no vision model is needed. Anthropic's browser use tool uses both: element references for reliable targeting, screenshots for canvas-rendered interfaces with no usable tree.
The loop is identical everywhere: the model receives the page state, proposes one action, your software executes it, the new state goes back. Google's computer use documentation describes exactly this four-step cycle, with coordinates on a normalised 0–1000 scale. Everything runs at browser speed, one step at a time — the whole trick and the whole limitation.
Browser agent vs API integration
An API talks to a documented endpoint: fast, deterministic, versioned, and when the vendor changes something you get a deprecation notice. A browser agent guesses its way through an interface built for people, and when that changes you get no notice — you get a silently wrong result that looks like a successful run. Check for real plumbing first: Model Context Protocol gives agents a structured way to call actual tools, and many vendors now ship an MCP server.
Browser agent vs RPA
RPA drives interfaces through recorded selectors and a scripted sequence: change a button's element ID and the run stops with an error. A browser agent re-reads the page each step and re-plans, surviving redesigns that break RPA scripts — and failing differently, by carrying on and doing something plausible but wrong. RPA fails loudly, browser agents fail quietly. Our comparison of agents, chatbots and RPA covers where each earns its keep.
Browser agent vs chatbot
A chatbot produces text; a browser agent produces a state change on somebody else's server. A bad chatbot answer costs a moment of confusion; a bad agent action cancels a subscription or submits a form you cannot retract. Everything below follows from that gap in blast radius — the distinction drawn in our business guide to AI agents.
The honest reason this category exists
Browser agents exist because most small-business software has no usable API. Municipal and county portals, insurance carrier systems, supplier ordering sites, older practice management software, legacy accounting packages — much of what small and mid-sized businesses use daily exposes nothing a developer can call. The second version is pricing: plenty of products have an API but reserve it for a tier well above yours. When API access starts at $600 a month and the automation is worth $200, that maths fails.
So be clear about what this is — a fallback, not a superior approach. If a documented API exists and you can afford the plan that includes it, go build the integration. The case genuinely unique to browser agents is the report that renders on screen with no export button and no endpoint. The data is right there, and nothing else can get it out.
The main options as of September 2026
This category changes monthly — one of its most prominent products was retired mid-2026. Treat the following as a snapshot verified in September 2026 and check the vendor's page before committing.
Browser agents inside the big assistants
ChatGPT shows how fast this moves. OpenAI launched a standalone browser, ChatGPT Atlas, on macOS in October 2025, then retired it on 9 August 2026, moving the capability into the ChatGPT desktop app's built-in browser and a Chrome extension. Agent mode runs multi-step tasks in a cloud browser and absorbed the earlier Operator functionality; OpenAI lists it on Pro, Plus, Business, Enterprise and Edu with per-plan message allowances. Suits people already paying for ChatGPT.
Claude in Chrome is Anthropic's extension, reading, clicking and navigating in a side panel inside your own browser; its support docs list it on all paid plans. It requests Chrome's debugger permission, which is what lets it click and type rather than only read. Two approval settings ship — automatically approve, where Claude screens each action and pauses when sign-off is needed, and manually approve, where you review everything first — and Team and Enterprise admins get site allowlists and blocklists. Suits teams wanting a supervised agent.
Gemini in Chrome with auto browse is built into the browser, rolling out on desktop from 28 January 2026 to AI Pro and AI Ultra subscribers in the US and later to Android. Google says its models are trained to detect prompt injection, and that auto browse asks for confirmation before some sensitive tasks. Suits businesses standardised on Chrome and Workspace.
Perplexity Comet is a Chromium browser whose assistant sidecar holds context across your open tabs. It is free to download on macOS, Windows, iOS and Android; paid plans add background assistants running tasks in parallel. Suits research-heavy work where the answer matters more than completing an action.
The developer APIs that drive a browser
Anthropic's browser use tool went generally available in August 2026 on the Claude API and Vertex AI, though the docs note it is not on Amazon Bedrock or Microsoft Foundry. It is a client toolset — Claude returns the actions, your infrastructure runs the browser — shipping around 31 member tools with the riskier ones (javascript_exec, file_upload, read_console, read_network) disabled by default, billed as ordinary tokens.
Google's computer use models take the screenshot-and-coordinates route. As of September 2026 the docs list Gemini 3.7 Flash as the recommended GA option, with 3.5 Flash and Flash-Lite also GA and the Gemini 2.5 preview deprecated. The API returns a per-action safety decision — allowed, require_confirmation, or blocked — across seven policy categories, plus optional prompt injection detection that scans screenshots.
Both bill against your own account, so you can cap what a run costs — see our explainer on bring-your-own-key AI and real API costs.
The open-source libraries
Browser Use is an MIT-licensed Python library (3.11+) built on Playwright, connecting to OpenAI, Anthropic, Google or local Ollama models. Its repository showed roughly 112,000 GitHub stars in September 2026 — attention, not production readiness. A paid Browser Use Cloud adds hosted browsers, proxy rotation and CAPTCHA solving. Suits Python teams wanting a fast prototype.
Stagehand from Browserbase is MIT-licensed in TypeScript, Python and Go, and is the most pragmatic design here: natural-language primitives (act, observe, extract) sit alongside deterministic Playwright-style locators, so only genuinely variable steps go through a model — cutting cost and flakiness together. Suits teams already writing Playwright.
Skyvern is vision-first Python, using a swarm of agents and vision models rather than XPath selectors. Its licence deserves attention: AGPL-3.0, with an exception excluding the anti-bot measures in its managed cloud. The network clause matters if you plan to build a commercial product on it.
Playwright MCP from Microsoft is Apache-2.0 and narrowest in scope, exposing a browser through the accessibility tree over Model Context Protocol; its own docs now steer coding agents to its CLI instead, because large tool schemas and verbose trees burn tokens. Suits developers wanting browser control inside an existing agent. For the wider field, see our comparison of open-source AI agent frameworks.
Where browser agents genuinely work today
Research across many sites — checking twenty supplier sites for pricing, pulling competitor service pages, gathering permit requirements across county sites. Read-only, reviewable, cheap to get wrong.
Extraction from systems with no export. The report renders on screen, there is no CSV button, nobody will build you an API. An agent that reads the table into clean rows earns its cost quickly.
Repetitive form filling in supplier portals or internal systems you have an account on. Real value — but this is where approval gates start mattering, because you have crossed from reading to writing.
Monitoring and verification. Does the pricing page still show the right numbers after the deploy? Are the listings still live across those twelve directories?
The thread through all of these: read-heavy, reversible, verifiable, low-consequence if wrong. Every good use case in 2026 has at least three of those four properties.
Where they fail, without the softening
They are slow. An API call returns in milliseconds. A browser agent spends seconds on every step — page load, page read, model call, action — and a real task is dozens of steps. You pay tokens for each one.
They are far less reliable than an integration. These systems are non-deterministic: the same instruction against the same site on two days can take different paths and produce different results. If your process needs the same answer every time, this is the wrong tool, and prompt tuning does not fix it.
Layout changes break them — less catastrophically than RPA selectors, because the agent re-reads the page, but they still break, and usually into a wrong answer rather than an error. You find out during review, if you are doing one.
CAPTCHAs and bot detection stop them, as intended. Anthropic explicitly prohibits Claude from bypassing CAPTCHAs. Cloudflare now classifies AI traffic as search, agent or training — counting browser-use agents driving Chrome as agent traffic — and from 15 September 2026 blocks agent and training traffic by default on ad-supported pages for newly onboarded domains. If a site blocks your agent, that is the owner's answer, not an engineering problem to route around.
They should not be trusted with irreversible actions — purchases, payments, customer messages, filings, deletions, permission changes — because you cannot review an action after it has fired. Long tasks also drift: more steps means more chances to compound a small misreading into a large wrong action. Short scoped tasks with a checkpoint beat one long autonomous run.
Security: the part you cannot skip
The security problem is not that the model might make a mistake. It is that a browser agent operates with your full authenticated identity across every site you are logged into at once, and the untrusted content it reads arrives through the same channel as its instructions. That combination is new, and the industry has not solved it.
Anthropic's safety documentation calls prompt injection the biggest risk facing browser-using AI tools. OpenAI has said publicly it does not expect prompt injection to ever be fully solved, comparing it to scams and social engineering. Brave's security team calls it a systemic challenge across agentic browsers rather than one product's bug. When the vendors say that on the record, the honest response is to design around the risk rather than assume it away.
Prompt injection from web page content
The mechanism, plainly: you ask an agent to summarise a page, the page arrives as text, and the model has no reliable way to separate content it was asked to read from instructions written to be read by an agent. Anyone who can put text on a page you visit can put instructions in front of your agent. This is indirect prompt injection, and it compromises nothing — not your machine, not your network, not your accounts.
Brave's research on Perplexity's Comet is the clearest published chain. Hidden instructions sat in a Reddit comment behind a spoiler tag. Asked to summarise the page, the agent read them, pulled the user's email from their account settings, navigated to a lookalike domain to trigger a one-time password flow, read the code from the user's already-logged-in Gmail session, and posted both back as a Reddit reply. It was reported and fixed; the shape of the attack is the lesson, not the bug.
Brave's structural point is the one to internalise: the browser's classic defences do not apply. Same-origin policy and CORS exist to stop a script on one site reading another's data. A browser agent is not a cross-origin script — it is you, everywhere at once, carrying every session cookie you hold. The surface is wider than visible text, too: Brave later demonstrated injections hidden inside images. Assume anything the agent can perceive can carry instructions — images, HTML comments, alt text, hidden fields, page titles and URLs.
How to read the vendors' published attack numbers
Anthropic published real figures with the original Claude for Chrome research preview. Across 123 test cases representing 29 attack scenarios, autonomous browsing without mitigations showed a 23.6% attack success rate when deliberately targeted; with mitigations it fell to 11.2%. On a narrower set of four browser-specific attack types, mitigations took it from 35.7% to zero. Anthropic has since reported better numbers with further classifier work, and the extension reached general availability on paid plans in August 2026.
Read those numbers correctly: a published rate measures known attacks against a tested defence at one point in time, and attackers are not confined to the tested set. Treat it as a floor on your risk, never a ceiling, and never as permission to remove your own controls.
Credentials, sessions and session hijacking risk
An attacker does not need your password to cause damage through an agent. It inherits your session cookies, so everything you are already logged into is in scope for whatever it can be persuaded to do. If your daily browser holds sessions for email, banking, CRM and payroll, pointing an agent at an unknown page puts all of them inside the blast radius of one injected instruction.
So: never type passwords, API keys or card numbers into an agent's chat window, never save payment methods on accounts an agent uses, and never run one in the profile holding your sensitive sessions. Anthropic's guidance for its API browser tool spells out the production pattern — an isolated container or VM with minimal privileges, a fresh profile with no stored credentials, a domain allowlist enforced at the network layer and re-checked after redirects, and low-privilege accounts for any logged-in session.
Anthropic's safe-use guidance also lists what not to point its extension at: financial account management, legal documents, medical information, work accounts holding sensitive data, and sites holding other people's personal information. It notes the service is unavailable for HIPAA-covered organisations, and that Claude is barred from stock trading, bypassing CAPTCHAs, entering sensitive information and gathering facial images. Treat that as a floor for any browser agent.
Why consequential actions need human approval
Every serious implementation converges on the same control. Google's computer use API returns a per-action safety decision and expects your application to handle require_confirmation with a real user prompt. Anthropic's browser tool docs tell developers to check before each call rather than once per turn, because one model turn can contain several actions. Claude in Chrome ships two approval modes and requires permission before financial sites.
The conclusion is not subtle. Everyone building these tools shipped approval gates because approval gates are the mitigation that works. If your deployment has no gate on irreversible actions, you have skipped the one control the vendors consider necessary, and are relying entirely on a classifier its own maker calls imperfect.
Governance rules to set before you let one loose
Write these down before the first run, not after the first incident.
1. Start read-only for at least a month. No writes, no sends, no submits. Use the time to measure how often the output is right. If you cannot state an error rate after four weeks, you are not ready for write access.
2. Use least-privilege accounts — one service account per system, view-only where supported, never the owner or admin login. If the only credential you have is the owner login, that is a reason to wait.
3. Keep payment credentials out of reach. Remove saved cards from any account the agent touches, and never store payment details in the agent, its config or its prompts.
4. Gate everything irreversible — purchases, payments, outbound customer messages, third-party submissions, deletions, permission changes. A human sees the proposed action and clicks approve.
5. Enforce a domain allowlist at the network layer, so the agent reaches the sites the job needs and nothing else — in infrastructure, not by asking the model.
6. Isolate the browser in a dedicated profile or container, not the one holding your email and banking sessions. This limits blast radius more than any prompt engineering.
7. Log every action — page visited, action taken, result returned, timestamped and retained. If you cannot reconstruct what the agent did, you cannot investigate it or explain it to a customer.
8. Name an owner, build a kill switch that does not require the person who built it, and write the scope down in one page: what it may do, what it may never do, who approves what.
9. Re-verify weekly by sampling output against the source. Silent drift after a site redesign is the most common production failure, and sampling is the only thing that catches it.
If you are unsure which processes justify this level of care, the free automation audit is a three-minute self-serve questionnaire that scores your manual work and ranks the quick wins. No call, no cost — and it often shows that two of your five candidates have a proper API waiting.
Terms of service: automating a site you do not own
Pointing an agent at a site you do not own may violate its terms, and this is not theoretical. LinkedIn's user agreement prohibits using software, scripts, robots, crawlers or browser plugins to scrape or copy the services; prohibits bots or unauthorised automated methods to access it, download contacts, send messages, or create, comment on, like or share posts; and prohibits bypassing access controls. A browser agent doing outreach on LinkedIn sits squarely inside that language, and many SaaS terms read similarly. Read them as the site owner would — "it only does what I would do manually" appears in none of them.
Treat bot detection as a boundary, not a puzzle. Some vendors sell CAPTCHA solving and stealth fingerprinting as features — Browser Use Cloud and Skyvern's managed offering both advertise anti-bot capability — but a feature existing does not make its use compliant with the target site's terms, and that call belongs with your counsel, not your automation vendor.
The infrastructure is hardening the same way. Alongside that default blocking, Cloudflare is building signed-agent verification on Web Bot Auth, using HTTP message signatures so agent platforms can cryptographically identify themselves and site owners can tell a user-directed agent from a scraper. Site owners are getting an enforceable choice, and some will say no.
Automating systems you do own is a much smaller question — your own portal, your back-office tools, your vendor accounts under an agreement that permits it. That is where the defensible value sits, and where we point clients first.
Browser agent or a real integration?
If a documented API exists and you can afford the tier that includes it, build the integration — every time. Determinism, speed, error handling and a support contract beat a browser agent on every axis that matters.
If the API sits behind a tier costing more than the automation saves, do the arithmetic honestly: tokens per step across expected volume, hosted browser infrastructure, engineering time, and the cost everyone omits — weekly human review. Often the plan upgrade turns out cheaper than the browser agent meant to avoid it.
No API and a read-only repetitive task? A browser agent is reasonable and probably the only answer. No API and a write-heavy irreversible task? The answer is usually a person, a different vendor, or a renegotiation with the current one.
Where we land as a build shop: browser agents are the last resort in a build, not the first idea. Much of what clients bring us as a browser-agent problem turns out to have an API, an MCP server or a webhook nobody checked for. When one genuinely is the only route, it belongs in a narrow, logged, approval-gated corner of the system. Our builds start at $7,500, model costs run separately at roughly $30–150 a month paid directly to the provider under your own keys, and a typical build lands in about 30 days.
Who should try this now, and who should wait
Try it now if you have a specific, repetitive, read-only job on a system with no API, the data is not sensitive, you can run it in an isolated profile on a low-privilege account, and someone will actually review the output. Research, monitoring and extraction from export-less reports are the strongest starting points.
Wait if the work touches regulated data — health records, legal documents, financial account access — or if the only credential you could hand over is an owner login. Wait if nobody has time to review the output: an unreviewed browser agent is not automation, it is unverified data entering your business. Wait if the site's terms prohibit automated access.
The direction of travel is clear: better structural page understanding, per-action safety decisions in the APIs, cryptographic agent identity in the infrastructure. None of it justifies handing an agent your credentials and walking away yet. Start narrow, log everything, make the technology earn scope.
Frequently asked questions
What is an AI browser agent?
A language model connected to a real web browser it can control — loading pages, reading content, clicking, typing, filling forms and moving between tabs. It works through the visual interface a person uses rather than an API. Options run from features inside browsers and assistants, through developer APIs from Anthropic and Google, to open-source libraries you run yourself.
Are AI browser agents safe to use with logged-in accounts?
Not without controls. An agent in a logged-in browser inherits session cookies for every site you are authenticated to, so one malicious page can potentially reach all of them. The safe configuration uses a dedicated profile, low-privilege service accounts, a domain allowlist, no saved payment methods, and human approval on anything irreversible. Anthropic advises against using its extension for financial, legal, medical or sensitive work accounts.
What is prompt injection and why is it worse in a browser?
Prompt injection is when text the model reads as content gets treated as instructions. In a browser it is worse because the agent reads pages written by strangers while acting with your authenticated identity across every site at once. Brave's research on Comet showed a chain that began with hidden text in a Reddit comment and ended with a one-time password read from the user's Gmail and posted publicly.
Can a browser agent solve CAPTCHAs?
Some commercial services advertise CAPTCHA solving; mainstream assistant products deliberately refuse, and Anthropic prohibits Claude from bypassing CAPTCHAs outright. Treat a CAPTCHA as the site saying it does not want automated access. Working around it risks breaching that site's terms and carries legal exposure well beyond an automation decision. If a site blocks your agent, ask the vendor for API access instead.
Is it legal to run a browser agent on a website?
That depends on the site's terms and your jurisdiction, and it is a question for a lawyer rather than a blog post. Many major platforms prohibit it in writing — LinkedIn's user agreement bans bots, scripts, robots and browser plugins used to scrape the service or drive engagement. Automating systems you own, or third-party systems under an agreement permitting it, is far safer.
What is the best open-source browser agent?
There is no single best, and the licence should drive the decision as much as the features. Browser Use (MIT, Python, Playwright-based) is the fastest path to a prototype. Stagehand (MIT, TypeScript/Python/Go) mixes natural-language steps with deterministic locators, usually meaning better reliability and lower token spend. Skyvern is vision-first and AGPL-3.0, so check the network clause. Playwright MCP (Apache-2.0) is lightest for browser control inside an existing agent.
How much does a browser agent cost to run?
The open-source libraries are free; the model calls are not. You pay tokens for every step, so a forty-step task means forty model calls plus page reads or screenshots — far more than a single API request. Add hosted browser infrastructure if you use a cloud runner. The largest real cost is human: review time to confirm the output is right.