Tencent has released BrowserSkill, an open-source tool that allows AI agents to control a user’s existing, logged-in Chromium browser through a command-line interface and browser extension.
The project is designed to let agents including Cursor, Claude Code and Codex use real browser sessions instead of starting a separate browser with an isolated profile. This allows agents to work with websites where a user is already signed in while keeping the agent’s activity in a separate browser window.
Tencent describes BrowserSkill as a local bridge between an AI agent and the browser. The project is available under the MIT license and supports other shell-capable agents beyond the integrations specifically listed by Tencent.
According to Tencent’s BrowserSkill repository, supported agent environments currently include Cursor, Claude Code, Codex, OpenClaw, CodeBuddy, WorkBuddy, Pi, Hermes Agent and DeepSeek Harness. Agents can use the bsk command-line interface rather than depending on a particular AI model or framework.
The system uses two main local runtime components: the bsk CLI and daemon, and the BrowserSkill browser extension. The architecture routes commands from an agent through the CLI and daemon to the extension, which then controls the browser.
BrowserSkill creates a dedicated, visible Agent Window for browser tasks. Tencent says this allows users to continue using their normal browser windows while an agent carries out its work separately. Multiple sessions can have separate Agent Windows.
The system can reuse the browser profile’s existing login state. When an agent needs to interact with a tab that the user already has open, however, the tab must be explicitly borrowed. Tencent’s documentation says the agent should return the borrowed tab when the task is complete, while other user tabs remain outside the agent’s control. 3
Human intervention is also built into the system. When an automated workflow reaches a CAPTCHA, login prompt, confirmation dialog or another step that requires a person, the agent can request human assistance before continuing.
BrowserSkill supports browser navigation, page inspection, screenshots, console and network inspection, clicking, hovering, scrolling, form filling, selection and keyboard input. Its tab controls include creating, selecting, closing, borrowing and returning tabs, while its assistance functions include resizing, emulation and requests for human help.
The tool is aimed at more than basic navigation. Tencent’s supplied agent instructions list uses such as reading pages, filling forms, scraping information, clicking through workflows, regression-testing a pull request’s user interface and validating deployed web pages. The instructions also explicitly tell agents not to extract credentials, cookies, tokens or other secrets.
BrowserSkill received a significant update with version 0.3.0 on September 16, 2026. The release added remote browser connections through a built-in server, one-use pairing links, device credential renewal and revocation, and support for native TLS or a TLS reverse proxy. Remote file uploads and downloads are not supported.
Version 0.3.0 also introduced optional operation auditing. When enabled, the daemon stores task history containing redacted operation metadata. Tencent says that audit information can be exported or deleted and is retained for 30 days. In remote deployments, the audit data is stored on the daemon host, including the server used for the remote connection.
The same release expanded the project’s visual capabilities with full-page screenshots, streamed PNG output, cancellation and lazy-loaded page capture. It also added Canvas visual references, on-demand element screenshots, screenshot-based point clicking and improved observation handling when an explicit token limit is used.
Tencent also added a scroll-to-element capability across the CLI, extension and DeepSeek Harness plugin. The feature supports elements inside iframes and includes cooperative cancellation and handling for visible bounds affected by ancestor clipping.
File transfer was introduced in version 0.2.0, including uploads, downloads and drag-and-drop uploads. The architecture documentation states that these transfers are currently limited to local connections; remote sessions return an unsupported result for file transfers.
The project supports macOS on both Apple Silicon and Intel, Linux on x64 and ARM64, and Windows x64. Google Chrome and Microsoft Edge are supported, while other Chromium-based browsers are expected to work when they support unpacked Chromium extensions. Firefox is listed as planned rather than currently supported.
BrowserSkill is also distributed through the Chrome Web Store. The listing shows version 0.3.0 and an update date of September 16, 2026. At the time of the latest listing data, it showed a 5.0 rating from 13 ratings and more than 20,000 users. The developer has declared that the extension does not collect or use user data and does not sell or transfer data outside the stated approved use cases.
The project is still under active development. Tencent’s GitHub repository lists open issues covering topics including Agent Window focus, tabs opened manually inside the Agent Window, browser startup behavior when no browser is running, and visual overlays that can interfere with analysis of page appearance.
BrowserSkill’s security model includes session-scoped references and borrowing controls, while Tencent’s architecture documentation says website cookies remain in the user’s browser profile. For remote access, device credentials are stored separately, access is governed through pairing and device grants, and the extension uses an origin allow-list for WebSocket upgrades.
The ability to operate an authenticated browser also introduces a security consideration for users and developers. An agent that can read web pages may encounter malicious instructions embedded in page content, creating a potential prompt-injection risk when the agent is also capable of taking actions within authenticated accounts. Tencent’s documentation provides restrictions around credentials and tab access, but those controls do not by themselves establish that every possible prompt-injection scenario has been eliminated.
Tencent’s GitHub security page currently reports that the repository has no SECURITY.md security policy and no published security advisories. That indicates the current state of the repository’s security documentation and disclosed advisories; it is not, by itself, a finding that the software contains a security vulnerability.
The broader technical significance of BrowserSkill is its use of an existing authenticated browser rather than requiring an isolated login environment. For coding agents, the model allows an agent to modify a web application, open the resulting page, inspect or screenshot the interface, interact with authenticated workflows and verify changes in a browser environment that reflects the user’s actual setup. These capabilities are consistent with Tencent’s documented browser-testing and page-validation use cases.
With the 0.3.0 release, BrowserSkill has also moved beyond a purely local browser-control model by adding authenticated remote connections and operation auditing. Those additions expand the environments in which the system can be used while making access control, authentication and browser-agent safety increasingly important considerations for deployments that involve logged-in accounts.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
