Letting Your Agent Drive a Real Browser
How Piskes gives an agent a real, interactive browser session, what's stored about that session, and how the approach compares to the rest of the computer-use field.
"Computer-use" agents — AI that can operate a real browser or desktop the way a person would, rather than only calling a documented API — are one of the most discussed categories in AI right now, and also one of the most overhyped. It's worth being precise about what Piskes actually built here, what it costs to run, and how it stacks up against the field.
What actually happens when an agent drives a browser
When an agent needs to interact with a live web page — one that doesn't have a clean API, or where the task genuinely requires clicking through a real interface — Piskes opens an interactive browser session through Cloudflare's Browser Rendering service, using its @cloudflare/puppeteer integration. The session is created with puppeteer.acquire(), which hands back a session id, and that id is what gets stored to track the session — not a bearer secret. The session authenticates at the account level, the same way any other Cloudflare Worker binding does, so there's no separate credential sitting in a database row waiting to be exfiltrated.
On the frontend, this shows up as a browser pane inside the ai-agent workspace — a live view of what the agent is doing, streamed through a route dedicated to that live session. You can watch the agent navigate, click, and read a page in something close to real time, rather than only seeing a text summary of what happened after the fact.
Sessions have a lifespan: they expire based on a keep_alive setting rather than running indefinitely, which matters both for cost and for not leaving an authenticated browser session open longer than the task needs.
Where this sits against the field
As of early 2026, the computer-use conversation has mostly split around one axis: a remote or cloud-hosted browser an agent controls, versus full control of a person's actual desktop. Piskes's implementation is squarely the former — a browser session the agent drives, not access to your machine's desktop. That's a narrower, safer surface: an agent that can misbehave in a sandboxed browser session is a very different risk than one with keys to your actual computer.
It's also worth being honest about the limits of the category generally, not just this implementation. Reported benchmark numbers put frontier models around 72.5% on computer-use tasks as of February 2026 — meaningfully better than a coin flip, meaningfully short of reliable. And speed remains a real problem across the field: one widely cited example had a leading agent take roughly 15 minutes to complete a haircut booking that takes a person about 30 seconds. Browser-driving agents are a genuine capability, not yet a fast one, and treating them as a replacement for a person doing routine, quick web tasks will disappoint you. Treating them as a way to hand off a browser-shaped task you'd rather not babysit yourself is a fairer expectation.
Why the "no stored secret" detail matters
It's a small architectural choice with a real consequence: because the session authenticates at the account level rather than via a stored bearer token, there's no long-lived browser credential sitting in the database for an attacker to find if they ever got read access to that table. What's stored is just an identifier pointing at a session Cloudflare's own infrastructure is holding — the kind of thing that's useless without the account-level access that created it in the first place. That's a meaningfully smaller attack surface than a design that persists a session token directly.
Using it well
Browser-driving is the right tool when a task genuinely needs a real interface — a site with no API, a login-gated dashboard, a form that has to be filled the way a human would fill it. It's the wrong tool for anything where a documented API already exists and would be faster and more reliable; reach for that first. And given the current state of the field, plan for a browser-driven task to take real time and to sometimes need a retry or a course correction — that's the honest current shape of the category, not a Piskes-specific limitation.