By Justin “Hutch” Hutchens | Trace3 Innovation Principal
For thirty years, building software usually meant building a browser interface. Login screens, dashboards, CRMs, ad managers, admin panels, and web portals all assumed the same user: a person with a mouse and a session cookie.
AI agents have exposed the limits of that design. Modern models can read pages, interpret interfaces, and choose what to click. Yet the web gives them very few reliable ways to identify themselves, request limited permissions, or act across sites. A new infrastructure market has emerged to fill that gap by giving agents remote browsers and the tools to operate them at scale.
This market may be transitional, but temporary infrastructure can remain valuable for a long time. Agentic browsers connect an internet built for people with a software ecosystem that is slowly developing interfaces for machines. That shift could take a decade, and it may never reach the long tail of the web.
APIs provide the cleanest way for software to interact with other software. They are structured, fast, predictable, and relatively cheap. Much of the software world, however, lacks a complete public API. Important functions often exist only inside a rendered or authenticated session. JavaScript loads the data, login walls protect it, and the user interface exposes actions the API omits. This is common in enterprise software, internal tools, web systems, and smaller SaaS products.
That makes the browser the closest thing the software industry has to a universal interface. If a person can complete a task online, an agent with browser access may be able to do the same without a custom integration. Managed browser platforms package that capability into infrastructure. Their common features include remote Chromium sessions, Playwright or Chrome DevTools Protocol access, session persistence, proxies, anti-bot tooling, CAPTCHA handling, and controls for running many sessions at once.
There is a growing narrative that Mythos represents a major leap forward in offensive cyber capability. That may be true. But it is also missing an important point. We have already been living in a world where frontier models can support autonomous hacking workflows.
Research from Google, Check Point, Anthropic, and others have shown that LLMs could already assist in zero-day discovery, automation of exploit development, and chaining together multi-step attack paths within the context of agentic workflows.
So yes, Mythos may be more specialized and more capable.
But the threshold between “AI can assist in hacking” to “AI can autonomously hack” had already been crossed. What Glasswing really represents is not the beginning of this trend, but its acceleration and industrialization.
Browser control is flexible, but its economics are poor compared with direct API access. An agent must repeatedly inspect a page, decide what to do, perform an action, and inspect the result. Each step adds latency and model cost.
Vision-based systems are especially expensive because screenshots consume large amounts of context. Accessibility trees and structured page representations can reduce that burden, though multi-step browser tasks still require far more computation than a single API request.
Reliability adds another cost. Pages change, sessions expire, CAPTCHAs appear, and actions fail halfway through a workflow. Production systems need retries, observability, state recovery, and human review for sensitive tasks.
These pressures are shaping a clear hierarchy for agent tools. Systems increasingly try a declared API, an MCP tool, or a known internal endpoint first. They open a browser when structured access is unavailable. Research on hybrid agents supports this approach, with reported gains over systems that rely entirely on browser navigation. The browser, therefore, serves as a compatibility layer for software that has yet to become agent-accessible.
Enterprise software has gone through a similar cycle before. Robotic process automation (RPA) grew because companies needed to move data through systems with no useful APIs. RPA tools copied the steps of a human operator, but their fixed scripts often broke when an interface changed.
AI agents make this approach more adaptable. A model can reassess a page and choose a new path instead of replaying an exact sequence. Even so, the agent still inherits the underlying weaknesses of UI automation: latency, fragility, broad permissions, and limited auditability.
As agentic activity online increasingly becomes the standard for web content access, structured connections will become more readily available, especially for routine activity on large platforms. Nonetheless, agentic browser automation will remain useful across legacy systems, internal tools, small vendors, and sites that resist automated access.
Companies in this category share a core product, but they are pursuing different sources of value.
Managed browser clouds focus on reliable session infrastructure. Browserbase, Steel, Kernel, Anchor, and others compete on startup time, concurrency, session persistence, developer experience, deployment options, and pricing. Some offer open-source or self-hosted versions for customers with strict security requirements. Others optimize for high-volume scraping or long-running interactive sessions.
Data-network providers approach the market from the access layer. Bright Data and similar firms combine browsers with large proxy networks and anti-blocking systems. Their advantage comes from reaching sites reliably across geographies and traffic controls.
Perception and action tools sit above the browser. Solutions such as TinyFish, Stagehand, and Notte convert pages into simpler representations that models can understand with less context. These tools aim to improve accuracy and reduce the cost of reasoning over raw screenshots or complex page structures.
Authentication specialists focus on credentials, delegated access, and repeatable workflows behind login walls. Anchor, 1Password, WorkOS, Akeyless, and related vendors are working on ways to give agents limited access without scattering human credentials across prompts and session state.
Enterprise automation platforms are also folding agents into existing RPA products. They bring governance, workflow design, and established customer relationships to the market. Their installed base may matter as much as technical performance.
These layers overlap, and many vendors are expanding beyond their starting point. Browser hosts are adding extraction and workflow tools. Data providers are adding agent interfaces. Identity companies are building browser integrations. The market is still deciding whether customers will buy an integrated platform or assemble specialized components. No major model provider appears to control this infrastructure layer. Most browser services support several models and agent frameworks, which keeps competition centered on reliability, cost, security, and distribution.
Most current services run Chromium because it already supports the web and works with established automation tools. That convenience comes with overhead. Chromium was designed to render a complete visual experience for people, while many agents need only page structure, JavaScript execution, and the ability to take actions. Newer approaches are beginning to challenge the assumption that every agent needs a conventional browser. Cloudflare's Kitesurf uses a machine-oriented runtime while maintaining compatibility with tools such as Playwright and Puppeteer. Its design reflects a broader effort to reduce the CPU and memory required for agent sessions.
Another approach lets an agent use a person's existing, authenticated browser. This can simplify login and preserve access to local sessions, though it raises difficult questions about consent, permissions, and the boundary between human and agent activity. And while this approach may work well in delegated architectures (where a human is working directly with an agent), it falls short in fully autonomous deployments.
The market now includes three broad models: host a conventional browser, build a lighter runtime for machines, or operate through a browser the user already controls. Each makes a different tradeoff among compatibility, efficiency, and trust.
The strongest pressure on this market comes from agent-native interfaces. MCP servers, structured website actions, command-line tools, and transaction protocols can give agents direct access to defined capabilities. These connections are easier to secure and audit than a browser session with broad user permissions.
Large software vendors have strong incentives to support them. Structured interfaces reduce infrastructure costs, improve reliability, and give platforms more control over how agents use their services. Emerging standards such as WebMCP could also let websites declare actions in a form agents can understand without scraping the visible page. Adoption will be uneven. Major SaaS companies can maintain agent-facing interfaces. A regional logistics platform, an internal insurance portal, or a decade-old government site may never do so. Some publishers and marketplaces may also withhold structured access for commercial reasons.
Browser automation could therefore capture a shrinking share of each task category while continuing to grow in absolute volume. More agents will attempt more online work, expanding demand even as better interfaces handle the most common workflows.
Authentication may prove more important than browser hosting. Today's login systems assume a person is operating the session. When an agent uses that person's cookies or credentials, it often receives the same broad access. The service may have no reliable way to distinguish the agent, limit its authority, or determine who approved an action. A mature agent ecosystem needs scoped and time-limited permissions, clear delegation, action logs, revocation, and stronger controls for high-risk operations. APIs already support some of these concepts through tokens and permission scopes. Browser sessions usually do not.
Solving this problem would change the market. Browsers would remain necessary for compatibility, but the most valuable infrastructure could move toward identity, policy enforcement, and audit trails across every interface an agent uses.
Agentic browser infrastructure is likely to remain important throughout a long migration toward machine-accessible software. Its role will narrow as structured protocols spread, but the web's long tail will preserve demand for browser-based access.
The durable opportunity lies in making that access cheaper, more reliable, and safer. Faster runtimes and better page representations can improve efficiency. Session management and recovery can reduce failures. Identity and policy systems can make agent activity accountable.
The central market question is how much online work will remain trapped behind interfaces built for people. Closely related is the question of who will control an agent's identity and permissions when it crosses those interfaces. The answers will determine whether browser hosting becomes a large standalone category or one component of a broader agent access layer.
If you’re curious to learn more or want to stay on top of the latest developments in Innovation, feel free to reach out to us at innovation@trace3.com.
Justin “Hutch” Hutchens is an Innovation Principal at Trace3 and a leading voice in cybersecurity, risk management, and artificial intelligence. He is the author of “The Language of Deception: Weaponizing Next Generation AI,” a book focused on the adversarial risks of emerging AI technology. He is also a co-host of The Cyber Cognition Podcast, a show that explores the frontier of technological advancement and seeks to understand how cutting-edge technologies will transform our world. Hutch is a veteran of the United States Air Force, holds a Master’s degree in information systems, and routinely speaks at seminars, universities, and major global technology conferences.