Browser Agents, Explained: The Tools That Click Buttons for You

This information is correct as of September 2026. Growth Method has made every attempt to ensure the accuracy and reliability of the information provided.

Every marketing team hits the same wall eventually. There is a task that takes four minutes, happens every week, and cannot be automated, because the tool has no API.

Google Search Console’s “Request indexing” button is the classic example. There is no API for it. Brave’s URL submission form is another. So is half of every ad platform’s reporting UI, most legacy CRMs, and every supplier portal your finance team logs into.

Browser agents exist to solve this. They are worth understanding, because most now have a free tier that covers a weekly task outright, and they connect to your existing AI tools through MCP.

What is a browser agent? It is software that drives a real web browser on your behalf, using an AI model to decide what to click, type and read. Unlike a scraper, which fetches raw HTML, a browser agent operates the page the way a person would: logging in, filling forms, navigating multi-step flows and adapting when the layout changes.

What a browser agent actually is

The clearest way to understand the category is by what it replaces.

A scraper fetches a page and parses it. Fast, cheap, and useless the moment the content is behind a login or rendered by JavaScript after three clicks.

Traditional RPA records a fixed sequence of clicks and replays it. Reliable until the site changes a CSS class, at which point it breaks silently and stays broken.

An agentic browser is the consumer version: Perplexity’s Comet, Claude in Chrome, Gemini in Chrome, the late ChatGPT Atlas. You watch it work in your own browser window, on your own logins. Useful, but you cannot schedule it, wire it into a pipeline or run it while you sleep. It also carries a security problem of its own, covered below.

A scraping API with browser actions sits between the two. You get a scrape endpoint that will click, type and wait before it captures the page. Enough to get past a cookie banner or open a tab, not enough to run a workflow.

A browser agent runs a real browser, usually on someone else’s infrastructure, and puts a model in the loop. It reads the page, decides what to do next, and can recover when the page is not quite what it expected. That flexibility is the whole point, and it is also what makes browser agents slower and more expensive than a scraper.

The category has moved quickly because the constraint was never model quality. As Browserbase founder Paul Klein IV put it in an interview at the AI Engineer World’s Fair:

“We mostly solved accuracy, but speed is still the biggest concern, and I think that will be the next big unlock.”

Paul Klein IV, founder and CEO of Browserbase, interviewed by WorkOS, 5 August 2026

How browser agents work

Under the marketing copy, every one of these products is the same four layers. Knowing them makes the differences between vendors much easier to read.

The browser

A real Chrome or Chromium instance, usually headless, running on someone else’s infrastructure. This is the part vendors call a “cloud browser” or “browser infrastructure”. What varies is cold-start time, how many you can run at once, and where in the world the traffic appears to come from.

The driver

Something has to send commands to that browser. In practice this is always the Chrome DevTools Protocol, usually wrapped in Playwright or Puppeteer. This layer is commoditised, which is why almost every vendor supports the same libraries and why moving between them is less painful than it looks.

The perception layer

This is the first real fork in the road, and it drives both cost and reliability.

Some agents read the accessibility tree: the structured representation browsers already build for screen readers. It is cheap, fast, and needs no vision model. Playwright’s MCP server works this way.

Others read screenshots and reason visually. Slower and pricier, but it copes with canvas elements, unusual widgets and sites that are hostile to structured parsing. Skyvern built its reputation on this approach.

Several agent vendors now mix the two, and Anthropic’s new browser use tool bakes the hybrid into the model’s toolset. It returns the accessibility tree with a reference on every element alongside the screenshot, so Claude can click a named element rather than a coordinate and still see what the page looks like.

Neither is universally better. Accessibility-tree agents are the sensible default for ordinary business software. Vision agents earn their cost on the weird stuff.

The harness

Everything else: authentication, retries, session persistence, proxy routing, CAPTCHA handling and error recovery. This is unglamorous and it is where nearly all the real differences between vendors live. It is also the layer people underestimate when they try to build this themselves, discover it works in testing, and then watch it fail quietly in week six when a session expires.

The browser tools sold by the model vendors

In August 2026 the model vendors moved into this category, or appeared to. It is worth being precise about what they sell, because the marketing reads like a hosted browser agent and the product is something narrower.

Anthropic’s browser use tool went generally available on 20 August 2026, alongside computer use, the Skills API and the Files API. One entry in the tools array gives Claude 27 browser actions by default: navigate, click, type, scroll, tab management, a find tool that locates elements by description, and a read_page tool that returns the accessibility tree with a reference on every element. JavaScript execution, file upload and console and network reading are there too, switched off unless you enable them. Anthropic’s documentation is blunt about who runs what: the tool “lets Claude navigate, read, and interact with webpages in a browser that your application runs”, and “nothing runs on Anthropic’s side”. It is available on the Claude API and Vertex AI, and works with Opus 5, Sonnet 5, Opus 4.8 and the Fable models.

OpenAI’s computer use tool in the Responses API takes the same shape with less structure. The model returns mouse and keyboard actions, or for GPT-6 Astra writes Playwright code, and the documentation puts it plainly: “You provide the environment and execute the model’s requests.” It works from screenshots and coordinates, with no page-structure view.

Google’s Gemini computer use runs the same client-side loop on the Gemini 3.x Flash models. Send a screenshot, receive an action with the model’s stated intent, execute it in Playwright or on a cloud browser, repeat. Its distinctive features are an opt-in scan of each screenshot for hidden adversarial instructions, and a policy that financial transactions, data changes and messages need confirmation before the model proceeds.

What all three have in common is the layer they occupy. In the four-layer picture above they are the perception layer and the reasoning behind it. They are not the browser, and they are not the harness. You still need a Chrome running somewhere, a way to keep it logged in, and the retries, session recovery and approval steps that separate a demo from something you can leave running. That is what the vendors below sell, and the two worlds connect rather than compete: Browserbase, for one, publishes a reference integration for Gemini’s computer use model on its own browsers.

If your engineers already build on the Claude API and want to own the browser, the browser use tool removes a chunk of the perception work and is worth a look. If you want to describe a task and have it run on Tuesday, you want a browser agent vendor, and which model toolset that vendor uses underneath is their problem.

Anthropic’s launch post carried a data point from the computer use side that shows why these toolsets matter even when somebody else is running them:

“Our agents work inside healthcare and insurance systems that have no API. On the new computer use tool, our longest claims workflow went from 32 minutes to 13, cost per task fell about 30% across every workflow we tested, and completion hit 100%, with no changes to our prompts.”

Davide Locatelli, Research Engineer at Asteroid, quoted in Anthropic’s announcement, 20 August 2026

The two families

Vendors in this space started from one of two places, and it still shows in what they are good at.

Infrastructure first. Browserbase, Browserless, Steel, Kernel and Cloudflare Browser Run sell you a browser and get out of the way. You bring the logic. They compete on concurrency, cold starts, stealth and price. If you already know exactly what you want to automate, this is the cheaper and more controllable path.

Agent first. Browser Use, Skyvern and Anchor Browser sell you the decision-making too. You describe the task, the model works out the steps. Slower per run and more expensive per task, but you write far less code and it survives site changes better.

The line is blurring in both directions. Browserbase added Stagehand, then Director, and on 30 June 2026 launched Browserbase Agents: describe a goal, make one API call, get structured results back, with a handful of runs included in every plan. Browser Use and Anchor both sell the underlying browser separately. Kernel started as infrastructure and now sells managed authentication connections as a plan feature. TinyFish sells search, fetch, a per-step agent and a per-minute browser behind one API key. Pick based on which side you want to be responsible for, not on where the vendor started.

Where scraping APIs stop and agents start

You will see scraping APIs advertising browser actions, and it is worth knowing where the line sits. Context.dev, for instance, recently added actions that click, type and wait. Read the reference closely and they run after the page loads and before content is captured, capped at five per request, with no cookie store, session reuse or persistent profile. Logins appear in the documentation only as an error condition, in the field that warns you when you got a login shell instead of the page. That is a scrape with a preamble. Useful for getting past a cookie banner, not something that can log in and do a job.

The line is state. Firecrawl crossed it with its /interact endpoint: actions chain freely inside a session lasting up to 10 minutes, and named profiles persist cookies, localStorage and session state between calls. Once a product can hold a login across runs it is competing with the browser agents whether it markets itself that way or not. So the useful test when you evaluate anything here is not “can it click”, it is “can it still be logged in tomorrow”.

How to choose: the six things that matter

For a marketing team running a handful of tasks a week, concurrency and per-hour price rarely decide it. These six things do.

1. Hosted MCP, or something you have to run

If you want your agent driving the browser from Claude, ChatGPT or your own stack, you want a hosted MCP endpoint: a URL and an API key, no local process to babysit and no server to keep alive.

Browser Use, Browserbase, Anchor Browser, Hyperbrowser and Skyvern all offer one. Skyvern’s is the newest, and the only one of the group that supports OAuth sign-in as well as an API key. Check how it authenticates, because it varies: an API key in a URL query string, which is still how Browserbase’s hosted endpoint works, is worse than one in a header, and OAuth is better than both. Watch for two traps. First, some “hosted MCP” options are a third-party wrapper service rather than the vendor’s own endpoint. Second, check what the tools do. Cloudflare’s hosted browser MCP sounds ideal until you read the tool list: it fetches HTML, converts to markdown, takes screenshots and crawls. It cannot click anything. Cloudflare does document a second route, running Google’s Chrome DevTools MCP server on your own machine against a Browser Run session, which can click and type, but that is a local process, which is the thing hosted MCP was meant to spare you.

2. How authentication is handled

This is the single most important criterion and the one buyers skip. If the task needs a login, the question is not “can it log in”, it is “what happens in week six when the session dies”.

Look for three things: persistent profiles so a human can log in once and agents reuse that state; credential isolation so passwords resolve at typing time and never reach the model, your logs or the API response; and session recovery so an expired login gets repaired rather than silently failing.

Anchor Browser is strongest here and sells authentication as the product. Browser Use is close behind and lets you sync your existing Chrome profile with one command. Browserbase’s Contexts save cookies and session state for reuse. Cloudflare Browser Run has nothing built in at all.

3. How you pay

The split is between pay as you go with no commitment and monthly subscriptions with included usage. For a task running a few minutes a week, that difference dwarfs any per-hour rate. A 50 dollar monthly minimum on a job that consumes 20 minutes a month is a bad trade no matter how good the product is.

Free tiers have shifted from monthly allowances to credits, and the expiry rules differ. Browser Use gives new accounts a one-time 15 dollars, Anchor gives 5 dollars a month, Kernel gives 5 dollars a month, and Steel gives 30 dollars once, which lapses after 90 days. Read the small print before you plan around a free tier.

4. Where the traffic comes from

Every browser agent request arrives at the target site from somewhere, and the target site has an opinion about it.

Cloudflare Browser Run is explicit that requests originate from Cloudflare’s network, that you cannot configure IP rotation, that requests carry identifying headers, and that they are always identified as bot traffic. That is fine for your own properties and a problem for anything with serious bot detection. Hyperbrowser and Anchor sell the opposite: residential-style egress, fingerprint randomisation and CAPTCHA handling.

Be honest with yourself about which you need. Most internal marketing automation targets sites you have an account with, where the polite path is fine and evasion is the wrong instinct.

5. Whether it learns or you script it

Some products let you demonstrate a task and replay it. Browser Use’s open-source workflow-use project records your browser interactions once, converts them into a deterministic workflow, extracts variables from forms automatically, and falls back to the LLM agent when a step breaks. Skyvern approaches the same problem from the other end: the agent figures the task out once, generates reusable code from the successful actions, then replays that code with no model in the loop until the page changes.

Both matter more than they sound. A repeated task that runs deterministically is faster, cheaper and predictable. A task that re-reasons from scratch every week costs model tokens every week and can surprise you.

6. Security

A browser agent with access to your accounts is exactly the configuration security researchers warn about. Simon Willison, who coined the term prompt injection, frames it plainly:

“If you are a user of LLM systems that use tools (you can call them “AI agents” if you like) it is critically important that you understand the risk of combining tools with the following three characteristics. Failing to understand this can let an attacker steal your data.”

Simon Willison, “The lethal trifecta for AI agents”, 16 June 2025

The three characteristics are access to private data, exposure to untrusted content, and the ability to communicate externally. A browser agent logged into your accounts and reading arbitrary web pages has all three by design.

That stopped being theoretical in August 2026. At Black Hat USA, Zenity Labs demonstrated a family of zero-click attacks it calls PleaseFix against Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Copilot Edge. A single malicious email, calendar invite or web page was enough to make the assistant exfiltrate data or take over accounts using the victim’s own logins, in one case despite Claude’s “ask before acting” mode.

“Agentic browsers are trading away decades of hard-won security engineering for convenience. This is not a bug we can patch away.”

Michael Bargury, co-founder and CTO of Zenity, Zenity Labs press release, 5 August 2026

Anthropic’s own documentation for its browser use tool says the same thing in plainer language: “Claude sometimes follows instructions found in page content even when they conflict with yours.” Its recommended defences make a good checklist for any vendor you evaluate. Run the browser in a dedicated container with a fresh profile that holds no credentials. Restrict the hosts it can reach with an allowlist enforced at the network layer. Treat everything on the page, including tab titles and URLs, as untrusted. And have a human confirm anything that purchases, modifies an account, sends a message or accepts terms.

Practical mitigations: give each agent its own dedicated account rather than your personal login, scope permissions to the minimum, choose a vendor where credentials never reach the model, and keep a human approval step on anything that spends money or publishes publicly.

The main tools, compared

Pricing and capabilities as of September 2026. Verify before committing, because this category is moving fast: since our August review, Browser Use has replaced its monthly task allowance with a one-time credit, Anchor has halved its browser-hour rate and raised its proxy price, Skyvern now has a hosted MCP endpoint, and Browserbase Agents, launched in June, bundles managed agent runs into every plan.

Six more are worth knowing about, either because they show up on shortlists or because they are cheaper for a particular shape of job.

A rough decision rule. Low volume and occasional use: Browser Use, because pay as you go with no minimum means an idle month costs nothing. Difficult logins and MFA at the centre of the job: Anchor Browser, and the subscription is worth it, though price the proxy traffic first. Already writing your own Playwright and you just need somewhere to run it: Browserbase, Steel, Kernel or Cloudflare Browser Run. Strange interfaces that structured parsing cannot read: Skyvern, which now also qualifies if hosted MCP is on your list. Want to describe a task and never see a browser: Browserbase Agents or TinyFish, both priced by the run or the step.

What the benchmarks say, and how much to trust them

The most-cited public benchmark for agents on the live web is Online-Mind2Web: 300 tasks across 136 real websites, scored on whether the task was completed. Steel hosts a leaderboard that collects submissions. As of September 2026 the top of it reads Browser Use Cloud at 97 percent (March 2026), OpenAI’s GPT-5.4 native computer use at 93 percent (March 2026) and TinyFish at 90 percent (February 2026), with Gemini 2.5 Computer Use at 69 percent and Stagehand on the same model at 65 percent further down.

Three caveats before you let that order pick your vendor.

The judges differ. Browser Use reported its own 97 percent using an agentic judge it built built on the Claude Agent SDK. OpenAI’s figure used a different, screenshot-based judge with no public run data. Where the same agent has been scored both ways the gap is large: Gemini 2.5 Computer Use scored 69 percent with human judges and 57.3 percent with the benchmark’s automatic judge.

The benchmark is public and the sites are live. Browser Use’s own write-up attributes its remaining failures to sites that were unavailable, prompts that were ambiguous, and websites that changed after the tasks were written. That is honest, and it is also a reminder that a top score partly measures familiarity with 136 particular websites.

The tasks are not your tasks. None of the 300 involve your ad platform login, your MFA prompt or your session expiring in week six. Take three tasks from your own backlog, run them on the two or three vendors that pass the criteria above, and count what breaks. That afternoon is worth more than any leaderboard.

What we are building with one

We are wiring a browser agent into our own publishing workflow, and the reasoning is a useful worked example of the criteria above.

The goal is to get new articles into the indexes that feed AI answers. That breaks into three tasks, and only one of them turned out to need a browser agent at all.

Bing, which feeds ChatGPT. Solved with IndexNow, an open protocol that pushes new URLs to Bing, Yandex, Naver and Seznam in a single HTTP request. No browser, no form, no fragility. We run it after every publish. Google has never adopted it.

Brave, which feeds Claude. Anthropic lists Brave Search as a subprocessor for Claude’s web search, so Brave’s index is roughly what Claude cites, and almost nobody submits to it. Brave offers a public submission form with no API and no bulk option. That is a browser job, unless the form accepts a plain POST, which is worth 10 minutes of testing before building anything.

Google Search Console. This is the one that genuinely needs an agent. The Indexing API is restricted to job postings and broadcast events, and that restriction is enforced at the approval stage rather than merely documented. The URL Inspection API is read-only. So the “Request indexing” button has no programmatic equivalent, sits behind a Google login, and is capped at roughly 10 to 12 URLs a day.

Three lessons that generalise. Check for an API first, because two of our three tasks did not need an agent. Let authentication drive the vendor choice, because the Google login is the hard part and the clicking is trivial. And pair the agent with an API-based check, because we use the URL Inspection API to verify articles got indexed, which is how you catch a silently broken session.

When not to use a browser agent

Five cases where a browser agent is the wrong tool.

If there is an API, use the API. A browser agent is slower, costlier and far more fragile than an HTTP request. Resist the temptation to reach for the agent because it is more interesting.

If the task runs thousands of times a day, the per-run cost compounds fast and you want deterministic code with an agent only as a fallback, which is exactly what the record-and-replay features exist for.

If the site forbids it, read the terms. Better authentication handling makes a session survive. It does not make the site’s operator happy about it. Automating your own accounts on tools you pay for is not the same as automating someone else’s platform at volume.

If you only need a couple of clicks before reading a page, a scraping API with browser actions will do it for a fraction of the cost and complexity. Reach for an agent when the task has branching, state or a login.

If the failure mode is expensive, keep a human in the loop. Several vendors support pausing a run for approval and resuming with the session intact. Use it on anything that spends budget or publishes.

For a broader view of where this fits alongside other agent tooling, see our guides to MCP servers for marketers, MCP versus APIs and the best marketing AI agent builders. If your interest here is AI search visibility specifically, start with Answer Engine Optimisation and how AI visibility tools actually work.

About Growth Method

Browser agents solve the plumbing problem: getting an AI agent to operate the tools that were only ever designed for humans. Growth Method solves the layer above it.

Growth Method is the agentic marketing platform for B2B teams. Agents plan, launch and analyse campaigns from your live marketing data, so the automation you build with a browser agent feeds prioritised campaigns rather than sitting in a script nobody owns. Connect your existing stack and your team and your agents work through the same plan, launch, analyse workflow.

We are on-track to deliver a 43% increase in inbound leads this year. There is no doubt the adoption of Growth Method is the primary driver behind these results.

Laura Perrott, Colt Technology Services

Get started and put the tasks your browser agent runs on the same board as the campaigns they serve.

Frequently asked questions

What is a browser agent?

A browser agent is software that drives a real web browser on your behalf, using an AI model to decide what to click, type and read. Unlike a scraper, which fetches raw HTML, a browser agent operates the page the way a person would: logging in, filling forms, navigating multi-step flows and reacting when the layout changes. It exists because most of the web has no API.

What is the difference between a browser agent and a cloud browser?

A cloud browser is infrastructure: a hosted Chrome instance you drive with your own code via Playwright, Puppeteer or the Chrome DevTools Protocol. A browser agent adds the decision-making layer on top, so you describe the task in natural language and a model works out the steps. Browserbase and Cloudflare Browser Run sell infrastructure. Browser Use and Skyvern sell agents. Several vendors now sell both.

Do browser agents work with MCP?

Yes. Every major vendor ships a Model Context Protocol server, and most are hosted remotely so you connect with a URL and a key rather than running a local process. Browser Use, Browserbase, Anchor Browser, Hyperbrowser and Skyvern all offer hosted MCP endpoints, and Skyvern’s supports OAuth sign-in as well as an API key. Cloudflare’s hosted browser MCP is read-only, so it can fetch and screenshot a page but cannot click or fill forms.

How much do browser agents cost?

Billing splits into two models. Pay as you go with no commitment suits low-volume and occasional use: Browser Use gives new accounts 15 dollars of credits, then charges usage against credits that never expire, and Hyperbrowser sells credits directly, though purchased credits expire after 12 months. Monthly subscriptions with included usage suit steady volume: Browserbase starts at 20 dollars a month, Skyvern at 29 dollars, and Anchor Browser at 50 dollars. Most vendors have a free tier that covers small workloads.

Is a scraping API with browser actions the same as a browser agent?

No, though the gap is closing. Scraping APIs such as Context.dev now let you click, type and wait before capturing a page, which handles cookie banners and content behind a tab. The difference is state: Context.dev caps actions at five per request and has no cookie store, session reuse or persistent profile, so it cannot hold a login between runs. Firecrawl’s interact endpoint does persist sessions through named profiles, which puts it much closer to a true browser agent. If your task needs a login, check for persistent authentication before assuming a scraping API will cover it.

Are browser agents safe to give access to my logged-in accounts?

Treat it as a real risk, not a formality. A browser agent with access to your accounts sits squarely in what Simon Willison calls the lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate externally. In August 2026 Zenity Labs demonstrated zero-click hijacks of Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Copilot Edge from a single email. Choose a vendor that stores credentials as secrets the model never sees, scope each agent to a single dedicated account rather than your personal login, and keep a human approval step on anything that spends money or publishes.

Is Anthropic’s browser use tool a browser agent?

Not on its own. Anthropic’s browser use tool, generally available since August 2026, gives Claude a set of browser actions and a structured view of the page, but the browser runs inside your application, not on Anthropic’s side. OpenAI’s computer use tool and Google’s Gemini computer use work the same way. They are the perception and reasoning layer. You still need a browser to run, somewhere to host it, and the authentication, retry and session handling that turn a model into a dependable agent, which is what the browser agent vendors sell.

Which browser agent scores best on benchmarks?

On the Online-Mind2Web leaderboard, Browser Use reported 97 percent in March 2026, ahead of OpenAI’s native computer use at 93 percent and TinyFish at 90 percent. Treat the ordering loosely. The scores come from different judges, several are self-reported, and where the same agent has been scored by humans and by the automatic judge the results differ by more than ten points. Run a handful of your own tasks before trusting any leaderboard.