What Actually Happens When You Let AI Use Your Browser

Two weeks ago my terminal got a new door into my browser.

Since April I have been letting AI use a browser for me. A separate one, set up for exactly that.

Think of a work phone. It is still your phone. You bought it, you carry it, your name is on the bill. It just does not have your whole life on it. The accounts you need for the job are there and nothing else is.

That is what I built in April. Four extra browsers, one for each brand I work on, each signed into the handful of accounts that brand needs and blind to everything else. They stay logged in. Every so often one wants a fresh password and I go type it. The AI opens those, does the work, and every single thing it can see in there is something I put there on purpose.

Then Claude’s extension updated, and the assistant in my terminal could open the browser I actually live in. My email. My bank sitting signed in because I am a normal person with a normal amount of discipline. Ten accounts I keep straight during a working week, all logged in and waiting.

It got noticeably better at the job the moment it could do that. It is also holding a great deal more than it was.

What the difference actually is

My everyday browser knows me. It is signed into my email, my bank, my accounts, and it remembers my address and my cards so I never have to type them. That convenience is the entire point of a browser you have used for years.

The work browsers know almost nothing. Only what I signed them into, and nothing else.

Same software. Completely different reach. Work phone, personal phone, both mine.

So here is what to know before you turn this on. An assistant working in your everyday browser can reach everything that browser can reach. It is not breaking in. It is walking through doors you already left open, because you left them open for yourself, months ago, for your own convenience. That is exactly why it works better there. It is also why the choice is worth making on purpose instead of finding out later that you made it by accident.

If you are trying it for the first time, give it its own browser and see what it can do with that. You can always widen the door once you know how the thing behaves.

Where it stops

I expected to hand over a job and go make tea.

What happens instead is that it opens a tab, works through the thing, and then stops dead at a login screen and waits for me. Same at a security check. Anthropic built that pause in deliberately and wrote it into their own documentation. The machine gets to the door and hands me the key.

Once I noticed that pause, I started noticing all the other places I was already stopping.

It would gather ten things and eight would be right. It would fill a form correctly and pick the wrong option from a dropdown. It would finish a task and hand back something technically complete that no human being would actually send.

There is a study where researchers built a fake company and gave AI agents ordinary office work inside it. Browsing, messaging, the small tedious jobs. The best model finished about thirty percent of the tasks on its own. Thirty percent is genuinely useful. Thirty percent is also nowhere near leave it alone and go to bed.

So are we heading for a dead internet

Somebody is going to read all this and say the obvious thing, so let me get to it.

More than half of internet traffic is now automated. Fifty-three percent against forty-seven percent human, in the most recent count from the security firm Imperva. Cloudflare, which sits in front of an enormous slice of the web, published its own version in July and put it more carefully. More than half is non-human now.

That number sounds like the end of something.

Cloudflare made a point in the spring I have not been able to shake. They argued that sorting traffic into bots and humans has stopped being the useful question, because a huge share of that automated traffic is a machine running an errand for a specific person who is sitting right there.

Which is exactly what mine are. When my browser opens forty tabs at eleven at night, that is not the internet dying. That is me, working, through something that does not get tired. Somebody wanted that. Somebody is going to read the result.

The dead internet worry is really a worry about intention. Is there a person at the end of this, or is it machines talking to machines about nothing? The honest answer right now is that it is mostly still people. Enormously amplified, frequently clumsy, sometimes wasteful people.

The flagship did not make it a year

While I was getting comfortable with all this, something quietly instructive happened.

OpenAI launched an entire browser last October called Atlas, built from the ground up around this exact idea. On the ninth of August it stops working. Ten months. The capability is not going away, it is being folded back into their main app, but the standalone thing everyone pointed at as the future of browsing did not survive its first birthday.

I mention it because of what it says about the pace. If you have been waiting for these tools to settle down before you learn them, they are not going to settle down.

Anthropic says plainly that no browser agent is immune to being tricked by a malicious web page. OpenAI has said the same problem is unlikely to ever be fully solved. Two companies competing hard against each other, arriving at the same shrug. So keep your hand on it.

Why this matters most if you are on your own

Now the part I actually care about.

If you are one person trying to start something, this changes your arithmetic more than it changes anybody else’s.

The work I hand these browsers is work I would otherwise pay someone to do, or more realistically, work I would simply never get to. Checking that every link on a client site still resolves. Pulling this month’s numbers off four dashboards that refuse to talk to each other. Filling the same product details into three platforms. Reading a hundred entries and flagging the twelve worth my attention.

None of that is creative. All of it is necessary. It is the invisible tax on running something small, and it is why a lot of good businesses stall out, because the founder spends Tuesday on data entry instead of on the one thing only she can do.

But the job did not disappear. It moved.

What I do now is write the brief. I say what finished looks like, what to skip, what to never touch, what to bring back to me. Then I read what comes back and decide whether it is any good. Setup and directives on the front end, deliverables and judgment on the back end, and something doing the tedious middle at three in the morning.

That is a real change in what one person can carry. The person is still required.

For anyone hoping otherwise: if you cannot describe what you want clearly, none of this will save you. It will produce a large quantity of confidently wrong work very quickly, and you will still be the one who has to sit down and look at it.

I watch the window while it works. I have not been able to make myself stop. Something about seeing the cursor move on its own, clicking through a form faster than any hand could manage, and knowing that in about ninety seconds it is going to reach a login screen and wait for me to come and do the one part it cannot.

Forward → Upward ↑ Onward ↗︎
Mstimaj

Sources and Further Reading

• Imperva, 2026 Bad Bot Report: Bots in the Agentic Age.
• Cloudflare, Moving past bots vs. humans.
• Cloudflare, The agentic internet bot report.
• Anthropic, Claude Code Chrome integration documentation.
• Anthropic, Prompt injection defenses for browser agents.
• MacRumors, OpenAI’s ChatGPT Atlas Browser Is Shutting Down.