I read TechCrunch’s writeup of Anthropic’s CEO laying out a plan to slow frontier AI development, and the first thing that came to mind wasn’t safety. It was a Gmail login screen.

Specifically the one a test agent hit on Tuesday, running in a freshly spawned cloud Chrome, pointed at a model that would have read as science fiction in 2023. Smart as hell. Completely locked out.

The bottleneck was never the IQ

Garry Tan has been pushing open-weight distillation, Anthropic is arguing for a slower ramp, and most of the 2026 conversation treats model capability as the axis everything else rotates around. For browser agents, it isn’t. Hasn’t been for a while.

Watch what actually breaks. The agent doesn’t misread the inbox. It never reaches the inbox. It lands on an accounts.google.com form it has no credentials for, and then it either stalls or starts confidently inventing what your unread mail probably says. A stronger model fails the same way, just faster.

What browser-native context is actually made of

Not vibes. A list:

  • Session cookies for every SaaS tool you signed into this quarter
  • The SSO cookie your Okta session dropped, which is the thing that actually unlocks Salesforce, Workday, Jira, and that internal dashboard nobody documented
  • localStorage and IndexedDB, where a lot of modern web apps park auth state and unsaved drafts
  • Device trust signals, the ones deciding whether you get an MFA challenge or sail straight through
  • The tab you already have open, scrolled to the record you were reading

That last item gets undersold. Context isn’t only “am I authenticated.” It’s also “the thing I want worked on is already rendered, at a URL something can read.”

A remote CDP connection hands you a very fast stranger

The setup most people reach for is a Chrome on a server somewhere, driven over the DevTools Protocol, and it works beautifully right until the task touches something you had to log into, which in practice covers most work worth automating. So you get an agent that can reason about a Salesforce opportunity in the abstract but cannot open one.

Managed browser services have the same shape with better marketing. Fresh profile, no cookies, no history, no device fingerprint that any bank or CRM has seen before.

People try to bridge the gap by exporting cookies from their real profile and injecting them into the cloud browser, and it half-works for a day or two, until the session rotates or the site notices the mismatch between the cookie and the machine presenting it. Then you are back to screenshotting login walls into a chat window. I’ve watched teams spend more engineering hours on cookie-shipping plumbing than on the actual workflow they wanted automated. Which is a strange place for the industry to end up, given that every one of those engineers had a browser sitting right there, already signed into all of it.

Cloudflare does not care how smart your model is

Bot detection reads infrastructure, not intelligence. Datacenter IP, clean profile, automation flags on the CDP connection. Blocked. We wrote more about that in cloud browser agents and bot detection.

The extension version of the same task

An extension running inside your real Chrome profile inherits everything above for free, because it isn’t connecting to a browser. It is the browser. When Dassi reads the Salesforce record you have open, there is no auth step, no token exchange, no OAuth consent screen with eleven scopes on it. The record is on screen. The side panel can see the screen.

Same for the Gmail thread. Same for the Notion page behind your workspace SSO. Same for the invoice portal that has no API and never will. Or the admin tool your company built in 2019 that supports exactly one login method.

The model doing the reasoning is whatever you point it at, and you can swap it whenever you want, which is the part of the BYOK argument that people mistake for a pricing feature. It’s really a “the model is interchangeable, the session is not” argument. We got into that more in why smarter models don’t fix your context problem.

Slow it down, then

If frontier progress paused tomorrow, my browser agent would lose nothing, because nothing it does well comes from the last twelve months of capability gains. And if progress triples instead, a managed cloud browser still opens to a login screen where I am nobody.

So the pace debate can play out however it plays out. I’ll be over here, in a tab I’m already signed into, watching a very ordinary model do things a very good one can’t reach.