The top reply under opencode's launch post for Browse reads: "it's basically just giving a toddler access to my banking app."
The post itself pulled 4.9K likes in a day. So a few thousand developers looked at a browser agent and immediately pictured their savings account draining.
That reply is the whole story in one line. opencode shipped something well built, and the first reaction was fear.
Browse is an MCP server plus a Chromium extension. Your agent gets Playwright control over the browser you are actually signed into.
Your tabs. Your cookies. Your 1Password icon sitting in the corner.
No fresh headless Chrome, no logging into Gmail again, no replaying auth flows.
i installed it expecting a toy. Then i read the security page and realized they had thought about the toddler problem harder than the people joking about it.
And that gap, between the joke and the engineering, is the most interesting thing about this release.
What actually runs when you type a prompt
Three pieces. The MCP server, talking over stdio.
A relay listening on 127.0.0.1:19988. The extension, connected to that relay over a WebSocket, driving your tabs through chrome.debugger.
The agent never talks to Chrome directly. It talks to a local server that pretends to be a Chrome DevTools endpoint.
That indirection is the whole design. The relay holds named sessions, recordings, network capture and a journal. The extension only has to execute commands, not reason about them.
Most tutorials tell you the hard part is the model. It isn't. The hard part is state.
An agent that clicks something and then reasons from a screenshot taken two seconds earlier is guessing. The relay keeps the page and the agent in sync, which is why execute can run real Playwright code instead of forty separate tool calls.
i used to think the tool count was a detail. Then i watched a different MCP server dump a whole accessibility tree into context for every single click.
Your tabs, and the 10 minute rule
Agents open their own tabs in the background of the window you last used. Grouped together, collapsed unless you are looking at one.
They cannot steal focus. They cannot raise a window over your work, because page.bringToFront() is refused at the protocol level.
Tabs nobody touches for 10 minutes close themselves. Never while a script is running on them.
Then there's the handoff. When the agent hits a login, a 2FA prompt or a payment page, it hands the tab back with a small card showing the site's origin.
You do the human part, click Continue, and it picks up again.
Here's the detail i didn't expect: only a real click on that card or the toolbar button finishes a handoff. A page cannot fake it.
There's also a flight recorder. It keeps the last minute of video and saves it when something breaks.
i have debugged enough flaky UI automation to know that feature came from someone's actual bad afternoon.
Where it sits next to Claude and Codex
| OpenCode Browse | Claude in Chrome | Codex for Chrome | |
|---|---|---|---|
| Works with | any MCP client | Claude plans | OpenAI stack |
| Model | whatever you point it at | Anthropic | OpenAI |
| Source | open | closed | closed |
Claude's version is the polished one. Site level permissions, confirmation prompts, tight hooks into Claude Code.
Codex's version leans on the ChatGPT desktop app, uses your signed-in sessions, and covers Chrome, Edge, Brave, Opera and Vivaldi.
Both are tied to a vendor. Browse isn't, and that's the pitch.
But that freedom has a price. You can point it at a local model, and nothing leaves your machine except what your agent sends to its provider. You also own the setup, the updates and the bad afternoons.
The r/codex answer to "which is better for browser use" was blunt: "Codex is far faaaar better :) nothing beats codex in computer use."
Fair enough. Different tool, different job. Browse is for the person who already has an opencode setup and wants it to stop fighting a login wall.
The page that earns respect, then hands it back
Pairing uses ECDH. Each browser gets its own key. Both sides prove they hold it, over fresh nonces, on every connection.
The pairing code is XXXX-XXXX, works once, expires in ten minutes. Five wrong codes in a row void every pending one.
Domain allowlists resolve names first, then check the document's real remote IP, which covers DNS rebinding. Site secrets get typed into a field only after the frame URL is checked against the secret's origin.
The value never enters the execute realm. It doesn't land in logs, journals or HARs.
Real crypto. Real care. And then, a few paragraphs in:
It shares the relay's process, so it is not a security boundary: treat code an agent runs as code running as you.
i read that twice. They built the wall and then told you it's made of paper.
The part that's a race, not a fix
execute runs on Patchright, which hides navigator.webdriver and the Runtime.enable leak. Input moves on curved mouse paths with paced typing.
The extension adds nothing to the page except the handoff card and an optional ghost cursor, both inside a closed shadow root.
Then the docs say the quiet part out loud. This makes an agent hard to spot, not impossible.
The browser still shows its "started debugging" bar while the debugger is attached. Focus emulation keeps background agent tabs looking visible. And fillInput falls back to synthetic events, which it warns you about.
i appreciate that honesty more than i appreciate the feature. Every anti-bot claim in this space is a snapshot, and they wrote it like one.
They also refuse to solve captchas. After a navigation, execute reports Cloudflare, Akamai, DataDome, PerimeterX, Imperva and AWS WAF walls, waits up to 15 seconds for the ones that clear themselves, then tells the agent to hand it to you.
Somewhere in the middle of reading all this, i looked at my own tab strip. Forty one tabs. Three of them are the same docs page opened at different times because i forgot i already had it.
The 10 minute idle close is the first feature in years that would actually fix that for me. Not a tab manager, not a snooze extension. Just an agent that opens a tab, uses it, and quietly lets it die.
i have installed four tab managers. None of them survived a week.
The real talk
If your daily browser has your bank, your work SSO and your personal email in it, don't run this there. Not because the code is bad. Because that's one session with an LLM holding the steering wheel.
Make a separate profile. Turn on an allowlist. Read the section on OPENCODE_BROWSER_ALLOW_NODE before you flip anything, because that flag hands execute full Node access.
And be honest about the use case. If your agent just needs to read a page, a fetch tool does that for free and cannot click "Confirm transfer."
Most people don't need this. The ones who do will know within an hour.
Closing
The toddler joke is right, but not for the reason people mean it. Toddlers are not malicious. They are just extremely literal and very fast.
That's a decent description of an agent with chrome.debugger access to your logged-in life.
The fix was never a smarter toddler. It was a playpen, a badge that says RUN, and a button that always takes the tab back.
They shipped all three. Then they told you the playpen has a gap in it.
i respect that more than a marketing page claiming otherwise.
Top comments (0)