Get startedCLIAPIMCPWebDesktopAgentsSupportBillingChangelog
These docs are outdated. This section is no longer maintained. Current guides live in the Help Center.
← All changelog
August 18, 2026

Your agents get their own browser.

Some of the work only exists behind a login. LinkedIn, X, Reddit, YC: the page you need is behind a session, not an API call. Every agent now gets its own Chrome profile, signs in once, and stays signed in, separate from yours and from every other agent's. It can click, type, and fill a form, but it cannot run scripts, upload files, or reach anything on your network.

New
  • Agents can drive a real Chrome. Not a scraper and not an HTML fetch: the rendered page, as you would see it.
  • Every agent gets its own isolated Chrome profile, keyed to the agent. Its logins survive the turn, the day, and a restart.
  • That profile is never yours. Launching against a personal browser profile is refused outright, and the check follows symlinks so one cannot be pointed at yours.
  • This opens the work that needs a session: a LinkedIn search, a Reddit thread, your YC company page, a post on X. If the only way in is a login, an agent can now get there.
  • Agents can act, not just read: click, type, fill a form, pick from a dropdown, handle a dialog, switch tabs, and take a screenshot.
API
  • The browser tools are an allow-list, not a deny-list. Seventeen vetted tools are exposed and everything else is denied by default, so a new or unknown tool cannot arrive switched on.
  • Arbitrary JavaScript is denied: no evaluate, no unsafe code execution.
  • File uploads and raw network requests are denied, so the browser cannot be used to exfiltrate a file or forge a request.
  • Your internal network is unreachable. Loopback, private ranges, link-local, and the cloud-metadata address are blocked before the origin allow-list is even consulted, so the permissive default still cannot reach an internal service.