Browser-based agents can be given a task – find this, book that, fill in this form – and will navigate websites to do it. They work reasonably well and introduce a genuinely new category of risk.
What they do well
Repetitive work across sites that have no API. Gathering information from many pages. Filling long forms from data you supply.
Anything a person would do by clicking through the same sequence repeatedly.
What they do badly
Anything requiring judgement about whether a result is correct. An agent booking something will book something, and whether it booked the right thing requires checking.
Sites with unusual interfaces, which confuse them in ways that produce confident wrong actions.
The security problem
An agent browsing on your behalf is logged into your accounts. A page it visits can contain instructions aimed at the agent rather than at you – hidden text telling it to do something else entirely.
This is prompt injection applied to browsing, it is documented, and it is not solved. An agent with access to your email and a malicious page is a genuine risk.
What to do if you use one
Separate profile, separate accounts, no saved payment details in the profile the agent uses.
Confirmation required for anything that spends money or sends a message.
And supervision for anything consequential, which limits the usefulness considerably and is the correct trade at this stage.
Where this goes
Towards sites offering structured interfaces for agents rather than having them click through pages built for humans. That is cleaner and it depends on sites wanting agents to visit, which many do not.