Browser agents: what to check before one acts on your behalf

Extensions used to read a page and show you something. A browser agent acts instead — clicking, typing, filling forms, moving through multi-step tasks while you watch or while you do not.

The install dialog says roughly the same thing for both. The risk is not remotely the same.

What the permission actually covers

"Read and change all your data on all websites" is the standard grant, and for an agent it is literal: every tab you have open, signed into everything you are signed into. That includes your email, your bank if it is open, your employer's tools, and any admin panel you left in a tab.

Two questions follow, and neither is answered by the dialog:

Does it run everywhere, or only when invoked? An agent that activates on a keystroke and idles otherwise has a much smaller footprint than one watching every page for something to do. Some tools offer a per-site allowlist; that setting is worth more than any feature on the comparison table.

What leaves your machine? Most agents send page content to a model provider — sometimes the visible text, sometimes the full DOM, sometimes a screenshot. Which of those, and to whom, is the question, and the answer is in the subprocessor list rather than the marketing page.

The checks, in order

1. What does it send off-device, and to which provider? Look for a subprocessor list or a data-processing page. A tool that cannot tell you is telling you.
2. Does it ask before irreversible actions? Sending, purchasing, deleting, submitting. An agent that confirms before those is a tool; one that does not is an automation you have to supervise continuously, which defeats the point.
3. Where does it run? Everywhere by default, or where you invoke it. Look for a site allowlist.
4. Who publishes it, and how are they paid? A free agent with a model bill behind it has revenue somewhere. If you cannot name it, you do not know what the product is.
5. Is there a log? A record of what it did, that you can read afterwards. Without one there is no way to answer "what happened" when something goes wrong, and something will.
6. Can you export what it produced? The same question as any other tool, and easy to forget when the output feels ephemeral.

Where they genuinely help

• Repetitive form-filling across many similar pages.
• Extraction — pulling structured data out of pages that offer no export.
• Multi-step navigation through interfaces with no API, which is most administrative software.
• Comparison across a set of tabs, where the work is reading rather than deciding.

The pattern: tasks that are mechanical, verifiable at a glance, and cheap to redo if wrong.

Where they cost more than they save

• Anything transactional. Purchases, transfers, bookings. The failure is expensive and the review takes as long as doing it.
• Anything on a page you cannot fully see. An agent scrolling through a long document decides what matters, and you will not know what it skipped.
• Anything under an employer's data policy, since page content is now leaving through a subprocessor your organisation has not assessed.
• Anything where the interface can change under it. Agents driving a site they do not control break silently when the site is redesigned, and the failure looks like a wrong answer rather than an error.

An agent that reads is a convenience. An agent that acts is an employee with your credentials and no memory of what it did yesterday. Give it the access an employee would get, not the access your browser makes easy.

A setup worth the five minutes

• A separate browser profile for agent work, signed into only what the task needs. Not the profile with your email and bank.
• A site allowlist where the tool supports one.
• Confirmation on for anything irreversible, even when it slows the demo down.
• Read the log for the first week. It is the only way to learn what the thing actually does rather than what it appears to do.
• Review the extension list monthly. An extension that changes hands does not announce it, and an agent is the worst kind to inherit a new owner.

What is a browser agent?

A browser agent is an extension that does not only read a page but acts on it — clicking, typing, filling forms and moving through multi-step tasks on your behalf. The distinction from an ordinary extension is not the model behind it; it is that a browser agent takes actions you would otherwise take yourself, signed in as you.

That is why the same install dialog understates it. The permission text has not changed; what the software does with it has.

How much access does each kind of extension need?

The last row is the one that has no precedent in the previous 3. A browser agent inherits every session you have open, which for most people includes email, and email is the recovery path for everything else.

Does an agent need to run all the time?

No, and this is the single setting worth looking for before any feature. An agent that activates when invoked has a footprint measured in the tasks you gave it. One that watches every page for something to do has a footprint measured in your entire browsing.

The 6 checks, in the order that eliminates candidates fastest:

1. What leaves the device, and to which provider.
2. Does it confirm before irreversible actions.
3. Does it run everywhere or only where invoked.
4. Who publishes it, and how are they paid.
5. Is there a readable log of what it did.
6. Can you export what it produced.

Related reading: developer tools worth adopting, how to judge web apps generally, and AI tools added to software you already use.

The setup that costs 5 minutes

Run a browser agent in a profile of its own, signed into only what the task needs. The permission covers every open tab, so a profile without your email and bank is the difference between a bad update reaching a task and reaching your life.

Then read its log for the first week. The WebExtensions permission model explains what the grant covers; the log tells you what this particular agent does with it, which is the part no documentation can answer.

A browser agent is worth having for the mechanical work nobody enjoys. It is worth constraining because the permission it needs is indistinguishable, at install time, from the permission a hostile one needs. Both facts are true at once, and the setup above is what lets you act on both.