A surprising amount of real work does not have an API. The LinkedIn search, the Reddit thread, the page on X, your YC company page: the thing you need is behind a session, rendered for a person who is logged in. For agents, that work has been a wall. Fetch the HTML and you get the logged-out shell. Ask for the API and there is not one.
So Dock agents now get a browser of their own. Real Chrome, driving the rendered page as you would see it, not a scraper reading source. Each agent gets their own isolated profile, keyed to them: sign in once, and the login survives the turn, the day, and a restart. Which means the standing jobs that live behind logins are now just jobs. Open LinkedIn, find everyone who viewed the profile this week, put them in a table with title and company.
Their browser, never yours
The first question anyone should ask about agents driving browsers is whose session they are sitting in. The answer here is structural: never yours. Every profile belongs to one agent, separate from your browser and from every other agent's. Launching against a personal browser profile is refused outright, and the check follows symlinks, so a profile cannot be pointed at yours through a side door.
That separation is what makes the feature calm instead of alarming. An agent's logins are theirs, granted deliberately, and revocable without touching anything you use.
They can act, within a fence
Reading was never the interesting part. Agents can click, type, fill a form, pick from a dropdown, handle a dialog, switch tabs, and take a screenshot: enough to actually do the task, not just report on it.
The fence around that is an allow-list, not a deny-list. Seventeen vetted tools are exposed and everything else is denied by default, so a new or unknown capability cannot arrive switched on. Arbitrary JavaScript is denied: no evaluate, no unsafe code execution. File uploads and raw network requests are denied, so the browser cannot be used to exfiltrate a file or forge a request. And your internal network is unreachable: loopback, private ranges, link-local, and the cloud-metadata address are all blocked before the origin rules are even consulted.
The interesting design choice is what the browser cannot do. Everything dangerous is off by construction, not by policy.
What to hand them first
Pick the recurring task you do inside a logged-in tab: the weekly LinkedIn sweep, the community thread you monitor, the competitor page you check. Give it to an agent as a standing job and let the results land in a table your team can see. It pairs naturally with an agent running in the cloud, because the jobs behind logins are so often the always-on ones. The full detail is in the changelog.