agent-browser is a command-line browser built for AI agents, from Vercel Labs. Each action is a short shell command: open a page, take a snapshot of its accessibility tree with a reference for each element, then click @e2 or fill @e3 by reference. That makes it easy for a coding agent such as Claude Code or Codex to drive a real Chrome without writing Playwright scripts, and the text snapshot is far smaller for a model to read than a screenshot.
Around that core it adds what agent work needs: sessions and saved login state, an encrypted credential vault the model never sees, a domain allowlist, network interception, HAR capture, recording, a local dashboard showing the live viewport, plugins, and support for cloud browser providers. It is a native Rust binary and installs through npm, Homebrew or Cargo.
It is Apache-2.0, created in January 2026 and already at about 44,600 stars, at v0.39.4. It changes quickly, so expect new commands and flags between versions.
- Repository: github.com/vercel-labs/agent-browser
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Rust. Stars: 44.6K. Forks: 3,060. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 04ba526
Who it is for
Developers giving coding agents a way to test web apps, check deployments or fill in forms, and anyone who wants scriptable browser control from the shell.
Getting started
1. Install the CLI (brew install agent-browser and cargo install agent-browser also work)
npm install -g agent-browser2. Download Chrome for Testing for it to drive (first time only)
agent-browser install3. Open a page and list its elements with references
agent-browser open example.com && agent-browser snapshotThe npm package's postinstall step downloads the matching native binary from the project's GitHub releases. On Linux, agent-browser install --with-deps also installs the browser's system libraries.
Safety scan
We cloned vercel-labs/agent-browser at commit 04ba526 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries, no install scripts and no bare-IP URLs across about 200,000 lines, most of them Rust. The one pattern hit is a benchmark that installs Rust with rustup.
- scripts/postinstall.js, the npm install hook, downloads the binary for your platform from the project's own GitHub release for the installed version and, on global installs, points npm's shim at it. It contacts nothing else.
- It can reuse an existing Chrome profile (--profile), attach to a Chrome you are already signed in to (--auto-connect) and save that state to a file. Useful, but anything an agent then does happens under your accounts; the domain allowlist (--allowed-domains) limits where it can go.
- 440 advisories, 19 critical, but what you install is the Rust binary: cli/Cargo.lock has 20, one critical (extraction permissions in the zip crate 8.2.0). The rest are in the pnpm workspace, which includes the Next.js docs site, and in example projects.
- 2 workflows, none using pull_request_target; none of the 19 third-party actions is pinned. No security policy, contributing guide, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | 4 npm lifecycle scripts. 1 Cargo build script |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. 19 of 19 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often mine.example, active.test, dashboard.example.com, github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 440 advisories across 2,028 pinned packages: 19 critical, 128 high, 225 moderate, 58 low, 10 unrated. benchmarks/pnpm-lock.yaml: 50 packages, 26 advisories; cli/Cargo.lock: 344 packages, 20 advisories; examples/environments/pnpm-lock.yaml: 461 packages, 164 advisories; examples/eve/pnpm-lock.yaml: 545 packages, 74 advisories; pnpm-lock.yaml: 1,449 packages, 224 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| benchmarks/bench.ts:673 | download-piped-to-shell (test/example) | "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y 2>&1", |
npm lifecycle scripts (4)
docs/package.jsonpostinstall:fumadocs-mdxpackage.jsonpostinstall:node scripts/postinstall.jspackages/@agent-browser/eve/package.jsonprepare:pnpm -C ../sandbox run build && pnpm run buildpackages/@agent-browser/sandbox/package.jsonprepack:pnpm run build
Worst known vulnerabilities (24 of 440)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-4684-h2q9-2vcp | critical | zip@8.2.0 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targe… |
| GHSA-2464-fhr4-w9xw | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
| GHSA-2xp9-vwfh-vxw4 | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
| GHSA-673q-mjm6-r5xr | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
| GHSA-p293-qw3h-jr36 | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
| GHSA-jqcg-44mw-7w3h | critical | proxy-addr@2.0.7 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| GHSA-cg2g-xh64-v4q7 | critical | dompurify@3.4.11 | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output mo… |
| GHSA-2464-fhr4-w9xw | critical | next@16.2.6 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
| GHSA-2xp9-vwfh-vxw4 | critical | next@16.2.6 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
| GHSA-673q-mjm6-r5xr | critical | next@16.2.6 | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
| GHSA-p293-qw3h-jr36 | critical | next@16.2.6 | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
| GHSA-vcvr-r3jv-pc5j | critical | next@16.2.6 | Next.js: Remote Code Execution in next/og ImageResponse |
| GHSA-2464-fhr4-w9xw | critical | next@16.1.1 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
| GHSA-2xp9-vwfh-vxw4 | critical | next@16.1.1 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
| GHSA-673q-mjm6-r5xr | critical | next@16.1.1 | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
| GHSA-p293-qw3h-jr36 | critical | next@16.1.1 | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
| GHSA-2464-fhr4-w9xw | critical | next@16.3.4 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
| GHSA-673q-mjm6-r5xr | critical | next@16.3.4 | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
| GHSA-vcvr-r3jv-pc5j | critical | next@16.3.4 | Next.js: Remote Code Execution in next/og ImageResponse |
| GHSA-4cwx-7wf7-3272 | high | undici@7.24.1 | undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives |
| GHSA-hm92-r4w5-c3mj | high | undici@7.24.1 | undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse |
| GHSA-rfgv-xxqx-mfg5 | high | undici@7.24.1 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
| GHSA-vmh5-mc38-953g | high | undici@7.24.1 | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent |
| GHSA-vxpw-j846-p89q | high | undici@7.24.1 | undici WebSocket client vulnerable to denial of service via fragment count bypass |
By the numbers
| Stars | 44.6K |
|---|---|
| Forks | 3,060 |
| Contributors | 117 |
| Commits | 729 |
| Open issues | 327 |
| Open pull requests | 364 |
| Releases | 116 |
| Latest release | v0.39.4 |
| Licence | Apache-2.0 |
| Main language | Rust |
| Project age | 9 months |
| Last push | Oct 26, 2026 |
| Tracked files | 483 |
| Lines of code | 200.3K |
| Checkout size | 11 MB |
Lines by language: Rust 111.6K, JSON 44.3K, TypeScript 20.6K, Markdown 16.8K, JavaScript 4,155, YAML 1,012.
Questions
Is agent-browser free?
Yes. agent-browser is free and open source under Apache-2.0. It drives a local Chrome by default; the optional cloud browser providers it supports are separate services with their own pricing.
Does agent-browser work with Claude Code or Codex?
Yes. Any agent that can run shell commands can use it, which covers Claude Code, Codex, Cursor and others. The project also publishes a skill that teaches an agent its commands.
How is agent-browser different from Playwright?
Playwright is a library you write scripts with. agent-browser is a CLI where every step is one command and elements are addressed by short references from a snapshot, which suits a model deciding the next step as it goes. It talks to Chrome from a native Rust binary rather than a Node.js library.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.