AI browser automation for business: what agents really do

In short: an AI agent that uses a browser or a computer looks at the screen, clicks and types like an employee would. For an online store or a B2B company it pays off where there are no APIs: supplier portals, closed back-office systems, reports downloaded by hand. Where APIs exist, a classic workflow is still faster, cheaper and more predictable.

Key takeaways

The agent works on the interface, not directly on the data: it is the answer for closed systems, not the first choice.
The strongest use cases are order entry on portals, pulling data from supplier portals and recurring reports.
Desktop agents such as Claude Cowork add access to local files and scheduled tasks, with permissions you need to set up.
An open-weight model has downloadable weights, but its license may still rule out commercial use.
The main risk is prompt injection: you need minimal permissions and human sign-off on the actions that matter.
Logins, two-factor checks and competitor price monitoring need clear rules: dedicated users, each site's terms of use and the GDPR.

A large share of day-to-day operations still runs through a browser: the procurement portal of a big customer where you upload order confirmations, the carrier's account area, the marketplace seller dashboard, the supplier site that only exports price lists to Excel. Many of these systems have no API, and for years the only alternative to manual entry was recorded scripts that break whenever a button moves. AI agents that "read" the page change that, though not quite the way the demos suggest.

What is an AI agent that uses a browser or a computer?

It is software built on a language model that completes a task with screen, mouse and keyboard instead of a person. An AI agent is a system that decides on its own which steps to take to reach a goal; when its tools are the ones a human uses at a computer, this is called computer use.

It runs as a loop: the model receives a screenshot, picks an action (click, type, scroll), the application executes it and sends back a new screenshot, until the task is done. That is the pattern described in Anthropic's computer use tool documentation, which also points out that for tasks that stay inside a website the dedicated browser tool is the better fit, because it reads and acts on the page without needing a full desktop.

That gives three categories:

Browser agent: works only inside web pages, in a dedicated browser or in yours.
Computer agent: controls a whole desktop, usually a virtual machine, and can also use installed programs.
Desktop agent: an application that works on the user's own computer, with access to files, folders, connectors and the browser. This is the one that needs the most care with permissions.

What is business browser automation, and what changes with AI?

Business browser automation means letting software do the repetitive work your team does in web applications. Traditional tools replay a fixed sequence of steps; an AI agent interprets the page every time. That makes the agent tolerant of layout changes and non-standard documents, but slower, more expensive per run and less predictable.

RPA (robotic process automation) is software that replays recorded clicks and keystrokes on an interface. An API workflow connects two applications that exchange data directly, for example with n8n or Make, without going through a screen. I cover this in more depth in the guide to business process automation.

Criterion	API workflow (n8n, Make)	Scripts and RPA (e.g. Playwright)	AI agent on browser or computer
Needs an API?	Yes	No	No
When the page layout changes	Not affected	Usually breaks	Usually adapts
Speed	Seconds	Seconds to minutes	Minutes: every step needs a screenshot and a decision
Cost per run	Very low	Low	Higher: every screenshot uses model tokens
Predictability	High	High while the interface stays the same	Medium: a sample of results must be checked
Best for	Modern systems with APIs	Stable, high-volume interfaces	Closed, changing or low-volume interfaces

Cost is not a footnote. According to Anthropic's documentation, each screenshot is roughly 1,000 to 1,800 input tokens, and a twenty-step task easily piles up around twenty of them, even though the model can group a few short actions into a single turn. At a few dozen runs a day that is manageable; at thousands, an API integration or a script almost always wins.

What can AI agents actually automate for an online store or a B2B company?

They work best on tasks with three traits: they happen in an interface with no API, they follow a clear procedure, and mistakes can be caught before they cause damage. These are the most realistic cases.

Order entry on portals and back-office systems

Take a hypothetical scenario: a B2B electrical parts distributor receives around thirty orders a day by email as PDFs, each customer with its own format. An agent can read the PDF, open the web-based order system, fill in the order and stop before saving, so a person checks product codes and quantities. The same pattern works the other way round, when a large customer requires you to upload order confirmations, delivery notes or invoices to its own procurement portal.

Supplier portals: stock, prices and documents

Many suppliers publish price lists, stock levels and spec sheets only in a login area. For an online store reselling thousands of SKUs, an agent can log into the portal, download the latest price list, compare it with the catalog and flag price changes or stock-outs. Publishing the changes to the store is better done through the platform's API (Shopify, WooCommerce).

Recurring reports from several back offices

Every Monday someone opens the marketplace dashboard and the carrier's portal, downloads last week's numbers and pastes them into a spreadsheet. This is one of the best fits: low risk, the same procedure every time, an output that is easy to check. On a related topic, see how logistics digitalization for small and mid-sized companies is evolving.

Checks on your own site

A browser agent can walk through your store like a customer: confirm that promoted products show the right price, that the cart applies the discount, that the contact form actually arrives. It covers the checks someone does by hand today and then forgets.

Where it does not pay off: payments, messages to customers without review, bulk catalog changes and anything that already has a documented API. The same goes for running social media accounts: Anthropic's documentation notes that the model's ability to create accounts and to generate and share content on social platforms is limited, and the platforms have their own publishing tools and rules anyway.

Can you use an AI agent to monitor competitor prices?

Technically yes, on public pages: the agent opens the product page, reads price and availability and writes them into a spreadsheet. Before you do it, though, three things need to be clear.

Volume: for a few dozen products checked once a day an agent can be enough; for hundreds or thousands of SKUs every screenshot adds to the cost, and a dedicated script or a price-monitoring service is a better fit.
The site's terms of use: many sites regulate automated access in their terms of service, which you should read before you start. The robots.txt file does not settle the question: the standard that defines it, RFC 9309, states that its rules are not a form of access authorization. A path that robots.txt does not exclude is therefore not the same as permission.
Personal data: a company's prices and product pages are not personal data, but signed reviews or profiles of private sellers are, and the GDPR applies to them.

In B2B, price lists often sit behind a customer-only login. Using a customer account to collect a competitor's prices is a different matter from reading a public page, and it should be checked against the portal's terms and with a lawyer before any test. For the wider competitive picture, see the opportunities and challenges of B2B e-commerce.

Where does the agent run: on your computer, in a virtual machine or in the cloud?

There are three possible environments, and the choice affects security, maintenance and where your data travels.

Environment	How it works	Best for	Watch out for
The user's computer (desktop agent)	The agent uses the browser, apps and files of whoever starts it	One person's tasks, low volume	Open sessions and local files: permissions must be limited
Virtual machine or container in-house	An isolated environment on your own server; this is how Anthropic's reference implementation works, based on Docker	Recurring processes, data that must stay in-house	Someone has to set it up and maintain it
Cloud browser	A service provides "headless" browsers, meaning browsers with no graphical interface, started on demand with isolated sessions (for example Browserbase)	Variable volume, many sessions in parallel, no servers to manage	Pages pass through one more provider: you need a data processing agreement

One detail that matters for privacy: according to Anthropic's documentation, computer use is a client-side tool, so screenshots, actions and session files are stored in the user's environment, not by Anthropic, which processes the images in real time during the API call under the API's data retention rules. Traditional scripts fit all three environments too: Playwright, for example, works with Chromium, Firefox and WebKit, on Windows, Linux and macOS, with or without a visible window.

Desktop agents: what does Claude Cowork actually do?

Claude Cowork is Claude's agent mode, which started in the desktop app: it brings the capabilities of Claude Code, originally built for developers, to office work, with no terminal required. You give it a goal and it works across files, connectors and the browser. The product moves fast: the official page says Cowork and chat are merging into a single Claude experience, so names and menus may change. Here is what the official getting-started guide stated when checked in November 2026:

it is available on paid plans, in the desktop app as well as on the web and mobile;
on desktop it only reads and writes in folders you have connected;
on websites it can open pages, read them, click, type and fill in forms, using a built-in browser or your own Chrome through the Claude in Chrome extension;
approvals come in three modes: manual, automatic and no approvals;
scheduled tasks run in the cloud, so your computer does not need to stay on;
it asks for explicit permission before permanently deleting a file.

The product page adds a useful detail about how it works: Claude uses connectors first, then the browser, and the screen itself only as a last resort. That screen-level computer use is still a research preview in Cowork and asks for permission before accessing each application.

In practice, a desktop agent suits one person's tasks: the weekly report, reconciling two spreadsheets, collecting documents from three portals. A process that has to run all the time, at high volume and with a log of every operation, belongs on a server-side workflow, possibly with an agent inside it. It is the same reasoning that applies to AI agents versus SaaS subscriptions.

What is an open-weight model, and why does it matter for agents?

An open-weight model is an AI model whose developer publishes the weights, meaning the numerical parameters learned during training, as downloadable files. Whoever downloads them can run the model on their own servers, adapt it with further training and use it without sending data to an outside provider, within the limits of the license.

Open-weight is not the same as open source. The Open Source Initiative's Open Source AI Definition also requires the code used to train and run the model and enough information about the training data to rebuild an equivalent system, together with the freedom to use, study, modify and share it. The 2024 NTIA report on models with widely available weights lists among their benefits the ability to use models without sharing data with third parties.

For agents this is a practical issue, because a screenshot of your back office often shows customer names, confidential prices and addresses. A verifiable example: in late September 2026 H Company published its Holo4 family, models built for computer use, on Hugging Face. Holo4-35B-A3B is released under Apache 2.0, which allows commercial use; Holo4-27B carries a CC BY-NC 4.0 license, which is non-commercial. Same family, same stated purpose, opposite usage rules: read the license before you run a single test.

An open-weight model makes sense when data must not leave the company or volumes are high, but it needs GPUs, in-house skills and maintenance. If you are just starting, a model accessed via API under a data processing agreement is the simpler route. For an overview of the open tools available, see the roundup of open-source frameworks for automating work.

Can an AI agent log into portals and handle credentials?

Yes, but every login is a sensitive point. Anthropic's documentation explains that if the model needs to log into an application, you can provide the username and password in the prompt, and it warns that using computer use in applications that require a login increases the risk of harm from prompt injection. The reason is simple: a tricked agent can do anything the open account allows.

Browser tools add their own controls. For Claude in Chrome, Anthropic lists site-level permissions that can be revoked at any time, a confirmation request before high-risk actions such as publishing, purchasing or sharing personal data, and a block on certain high-risk categories of sites, including financial services: online banking, for example, is off limits. On Team and Enterprise plans, admins can enable or disable the extension across the organization and set allowlists and blocklists of sites.

In practice:

create a dedicated user for the agent on each portal, with only the permissions it needs, so its actions stay distinguishable from people's;
do not reuse an employee's personal credentials or the admin login;
when the portal asks for a two-factor verification code, let a person do the login: the check is designed for a human, and working around it weakens the account's security;
if a portal shows a CAPTCHA, take it as a sign the operator does not want automated access: ask the supplier for an export or an API instead of looking for shortcuts.

What are the risks of giving an AI agent a browser?

The main risk is prompt injection: text found on a page or in a document that the agent mistakes for an instruction. The others are exposed credentials, irreversible actions and personal data in screenshots.

Indirect prompt injection is defined by OWASP as external content, such as a website or a file, altering the model's behavior in unintended ways. A practical example: a PDF order with an invisible line telling the agent to send your confidential price list to an outside address. Anthropic has published clear numbers: in its August 2025 tests of Claude in Chrome (123 test cases, 29 attack scenarios), attacks succeeded 23.6% of the time without defenses; with the mitigations added to autonomous mode the rate fell to 11.2%. Less than half, but not zero.

The safeguards in Anthropic's documentation match OWASP's advice:

run the agent in a virtual machine or container with minimal privileges;
keep it away from sensitive data, starting with personal login credentials;
restrict browsing to an allowlist of domains;
require a person to confirm actions with real-world consequences, such as sending, paying or deleting.

Then there is the GDPR: if screenshots contain customer data, the model provider is processing personal data and you need a processing agreement. It fits into a proactive approach to cybersecurity.

How reliable is an AI agent, and how do you check its work?

Reliable enough for tasks with a check at the end, not for tasks that need absolute precision. Anthropic itself lists the limits in its computer use documentation: latency may be too slow compared with a person, the model can get click coordinates wrong or pick the wrong action, and reliability drops with niche applications or several applications at once. That is why it recommends use cases where speed is not critical, such as background information gathering or automated software testing, and advises against using it without human oversight for tasks that need perfect precision or sensitive data.

For an online store or a B2B company, that translates into four checks:

Action log: keep screenshots, steps and outcome for every run, so a mistake can be traced in minutes.
Automatic reconciliation: compare totals (order lines, quantities, amounts) with the source document before marking the job as done.
Weekly sample: a person rechecks a fixed share of completed runs, a larger one during the pilot.
Exception count: track how often the agent stopped or asked for help; if the number rises, the process or the interface has changed.

Traceability of AI decisions is part of a wider governance question, covered in the guide to AI governance and explainability.

How to apply it in your company: first steps

Log browser-based tasks for two weeks: who does them, how often, how many minutes each.
Check each task for an API or an export: if one exists, use a workflow and skip the agent.
Pick one task with no API, low risk and clear metrics, such as a weekly report. Set three indicators: minutes per run, error rate, share of cases that need a human. The guide to KPIs for measuring AI value helps here.
Set up a separate environment: a dedicated account with minimal permissions, an isolated browser or virtual machine, allowed domains, human confirmation before every save or send.
Run a four-week pilot side by side: the agent works, a person checks, then you compare the indicators with manual work and decide whether to extend it.

This kind of project is part of custom business automation, where the tool is chosen to fit the process.

Mistakes to avoid

Using an agent where an API exists: you pay more for a less reliable result.
Handing the agent admin credentials: create a dedicated user with only the permissions it needs.
Letting it act freely on payments, outgoing messages and deletions: these always need human confirmation.
Working around two-factor checks or CAPTCHAs: if a portal uses them, ask for official access, an export or an API.
Judging by the demo: measure the average case and the exceptions, not a perfect first run.
Ignoring licenses and terms of use: check the model's license and whether the portal's terms allow automated access.

Frequently asked questions (FAQ)

What is AI browser automation?

It is the use of an AI agent that opens a browser, reads pages and performs actions such as clicking, filling in forms and downloading files on a person's behalf. It copes with layout changes better than traditional scripts, but it is slower and more expensive than an API integration.

Can an AI agent replace RPA?

Partly. Where interfaces change often or documents come in different formats, an agent is sturdier than an RPA bot. Where the process is stable and high-volume, RPA or a script stays faster and cheaper, and the best setup often combines the two.

How much does it cost to run an agent in a browser?

Cost depends on the number of steps, because each step needs a screenshot the model has to process: roughly 1,000 to 1,800 input tokens each, according to Anthropic. Add the infrastructure and the time spent supervising, then compare it with the cost of the person doing the task today.

Can Claude Cowork work on files on my computer?

Yes, in the desktop app and only in folders you explicitly connect. According to the official guide it asks for explicit permission before permanently deleting a file and is available on Claude's paid plans. Scheduled tasks run in the cloud.

Is an open-weight model also open source?

Not necessarily. Open-weight means the weights can be downloaded; open source, under the Open Source Initiative's definition, also requires the code, information about the training data and the freedom to use, modify and share the model. Some open-weight models carry non-commercial licenses.

Is it safe to give an agent access to supplier portals?

It can be, with a dedicated low-privilege account, an isolated environment, an allowlist of sites and human confirmation before the actions that matter. The risk to manage is prompt injection, meaning instructions hidden in pages or documents. If screenshots contain personal data, you also need a processing agreement with the model provider.

Do you need to code to use an agent in the browser?

It depends on the use. A desktop agent such as Claude Cowork runs from the app with no terminal: you connect folders and describe the task. An agent that runs every day on a server, connected to your order system, with logs and checks, needs real development work: an isolated environment, credential management and integration with your other systems.

Sources

If you want to know which of your browser tasks belong with an agent and which with a workflow, start with a free assessment.