IOSG Venture: When Your Browser Becomes a Proxy

Author｜Mario Chow & Figo @IOSG

Over the past 12 months, the relationship between web browsers and automation has drastically changed. Almost all big tech companies are scrambling to build their own browser agents (browser agents). Beginning at the end of 2024, this trend became more evident: OpenAI launched Agent mode in January, Anthropic released “computer usage” functionality for the Claude model, Google DeepMind launched Project Mariner, Opera announced Neon, and Perplexity AI launched Comet Browser. The signal is clear: the future of AI lies in agents that can navigate web pages autonomously.

This trend isn't just adding smarter chatbots to browsers; it's a fundamental shift in how machines interact with digital environments. A browser proxy is an AI system that can “see” a web page and act on it: click on links, fill out forms, scroll pages, type text: just like a human user. This model promises to unlock huge productivity and economic value because it can automate tasks that still require manual intervention or are too complex for traditional scripts to complete.

GIF demo: AI browser agent in action: follow instructions, navigate to the target data set page, automatically take a screenshot, and extract the required data.

Almost all of the big tech companies (and some startups) are developing their own browser AI proxy solutions. Here are a few of the most representative projects:

OpenAI's Agent mode (formerly known as Operator, launched in January 2025) is an AI agent with its own browser. Operators can handle a variety of repetitive online tasks: such as filling out web forms, ordering groceries, scheduling meetings: all through a standard web interface commonly used by humans.

▲ AI agents schedule meetings like professional assistants: check your calendar, find available time periods, create events, send confirmations, and generate an.ics file for you.

At the end of 2024, Anthropic introduced a new “Computer Use” feature to Claude 3.5, giving it the ability to operate computers and browsers like a human. Claude can look at the screen, move the cursor, click buttons, and type text. This is the first big model proxy tool of its kind to go into open beta, and developers can let Claude automatically navigate websites and apps. Anthropic positions it as an experimental feature with the primary goal of automating multi-step workflows on web pages.

AI startup Perplexity (known for its question-and-answer engine) launched Comet Browser as an AI-powered alternative to Chrome in mid-2025. The core of Comet is a conversational AI search engine built into the address bar (omnibox) that provides instant questions and answers and summaries rather than traditional search links.

In the previous article, we have reviewed how major technology companies (OpenAI, Anthropic, Perplexity, etc.) inject functionality into browser agents (browser agents) through different product forms. To understand their value more intuitively, we can take a closer look at how these capabilities are applied to everyday life and corporate workflows in real-world scenarios.

Despite its huge potential, today's browser proxies are still far from perfect. The current implementation reveals some long-standing technical and infrastructure challenges:

Modern networks are designed for human-operated browsers, and have evolved over time to actively resist automation. Data is often buried in HTML/CSS optimized for visual presentation, limited by interactive gestures (mouse hover, swipe), or only accessible through undisclosed APIs.

On this basis, the anti-crawler and anti-fraud systems have artificially added additional barriers. These tools combine IP reputation, browser fingerprinting, JavaScript challenge feedback, and behavioral analysis (such as randomness of mouse movements, time spent). Paradoxically, the more “perfect” and more efficient an AI agent is: for example, filling in forms instantly and never making mistakes, the easier it is to be identified as malicious automation. This can lead to hard failures: for example, OpenAI or Google's agents may successfully complete all steps before checkout, but end up being blocked by CAPTCHA or secondary security filters.

Giving agents full control often requires access to sensitive information: login credentials, cookies, two-factor authentication tokens, and even payment information. This raises concerns that both users and businesses can understand:

• What if the proxy goes wrong or is tricked by a malicious website?

• If an agent has agreed to a term of service or executed a transaction, who is responsible?

Based on these risks, the current system generally takes a cautious approach:

Google's Mariner doesn't enter credit card information or agree to the terms of service, but returns it to the user.

OpenAI's Operator prompts the user to take over the login or CAPTCHA challenge.

Anthropic's Claude powered agents may simply refuse to log in due to security concerns.

The result: frequent pauses and handoffs between AI and humans weaken the experience of seamless automation.

Despite these obstacles, progress is progressing rapidly. Companies such as OpenAI, Google, and Anthropic are learning from failure in every round of iteration. As demand grows, a kind of “co-evolution” is likely to occur: websites will become agent-friendly in favorable scenarios, and agents will continue to improve their ability to mimic human behavior to bypass existing barriers.

Today's browser proxies are facing two very different realities: on the one hand, the hostile environment of Web2, where anti-crawlers and security defenses are everywhere; on the other hand, it is the open environment of Web3, where automation is often encouraged. This difference determines the direction of each type of solution.

The solutions below fall broadly into two categories: those that help proxies bypass the hostile environment of Web2, and those that are native to Web3.

While the challenges faced by browser proxies are still significant, new projects are constantly emerging to try to directly address these issues. The cryptocurrency and decentralized finance (DeFi) ecosystem is becoming a natural testing ground because it's open, programmable, and less hostile to automation. Open APIs, smart contracts, and on-chain transparency have eliminated many common friction points in the Web2 world.

Here are four types of solutions, each addressing one or more of today's core limitations:

These browsers were designed from the ground up to be autonomous agent-driven, and are deeply integrated with blockchain protocols. Unlike traditional Chrome browsers, the latter requires additional dependencies on Selenium, Playwright, or wallet plug-ins to automate on-chain operations; while native proxy browsers directly provide APIs and trusted execution paths for agents to call.

In decentralized finance, the validity of a transaction depends on cryptographic signatures rather than whether the user is “human-like.” Therefore, in an on-chain environment, agents can bypass CAPTCHAs, fraud detection scores, and device fingerprinting common in the Web2 world. However, if these browsers point to a Web2 website like Amazon, they can't bypass the relevant defense mechanisms, and they will still trigger normal anti-bot measures in that scenario.

The value of a proxy browser isn't that it can magically visit all websites, but rather:

• Native blockchain integration: built-in wallet and signature support, no more need to go through MetaMask pop-ups or parse the DOM on the front end of the dApp.

• Automation-first design: Provides stable high-level instructions and can be directly mapped to protocol operations.

• Security model: Refined permission control and sandbox to ensure the security of private keys during automation.

• Performance optimization: Ability to execute multiple on-chain calls in parallel without browser rendering or UI delays.

Letting agents gain sensitive permissions is risky. Related solutions use trusted execution environments (TEEs) or zero-knowledge proofs (zKPS) to encrypt and confirm the agent's expected behavior before execution, enabling users and counterparties to verify proxy actions without revealing private keys or credentials.

Modern anti-bot detection systems not only check whether requests are “too fast” or “automated,” but also combine IP reputation, browser fingerprinting, and JavaScript challenge feedback with behavioral analysis (such as cursor movement, byte play, session history). Those proxies from data center IPs or completely repeatable browsing environments are easy to identify.

To solve this problem, such networks no longer crawl webpages optimized for humans, but instead directly collect and provide machine-readable data or proxy traffic through real human browsing environments. This method bypasses the vulnerability of traditional crawlers in parsing and reverse crawling, and can provide cleaner and more reliable input for agents.

By proxying proxy traffic to these real-world sessions, distributed networks (distribution networks) allow AI agents to access web content like humans without immediately triggering a blockade.

However, this isn't a complete solution. Behavioral testing (mouse/scroll trajectory), account-level restrictions (KYC, account age), and fingerprint consistency checks may still trigger the block. Therefore, distributed networks are best viewed as a basic hidden layer, and must be combined with execution strategies that mimic humans to be most effective.

Currently, more and more technical communities and organizations are exploring: If future network users are not only people, but also automated agents (agents), how can websites deal with them safely and in compliance?

This has prompted discussions on emerging standards and mechanisms. The goal is to enable websites to clearly state “I allow access by trusted agents” and provide a secure channel to complete interactions, rather than blocking proxies as “bot attacks” by default, as is the case today.

• “Agent Allowed” label: Just like robots.txt, which search engines comply with, future web pages may add a tag to the code telling the browser proxy “This is safe to access.” For example, if you use an agent to book a ticket, the website will not pop up a bunch of verification codes (CAPTCHAs), but will directly provide an interface after authentication.

• API gateway for certified proxies: A website can open a dedicated portal for verified agents, just like a “fast track.” Instead of simulating human clicks and inputs, agents follow a more stable API path to complete orders, payments, or data queries.

• W3C discussion: The World Wide Web Consortium (W3C) is already studying how to develop standardized channels for “managed automation.” This means that in the future, we may have a globally common set of rules that allow trusted agents to be recognized and accepted by websites while remaining secure and accountable.

Although these explorations are still in their early stages, once implemented, they may greatly improve the relationship between human ↔ proxy ↔ websites. Imagine: Agents no longer need to “trick” risk control by desperately imitating human mouse movements, but instead complete tasks through an “officially permitted” channel.

Crypto-native infrastructure is likely to take the lead on this route. Because on-chain apps are inherently reliant on open APIs and smart contracts, they are automation-friendly. By contrast, traditional Web2 platforms are likely to continue to be cautious, particularly companies that rely on advertising or anti-fraud systems. But as users and businesses gradually accept the efficiency improvements brought about by automation, these standardization attempts are likely to become a key catalyst for moving the entire Internet towards an “agent-first architecture.”

Browser proxies are evolving from what were initially simple conversational tools to autonomous systems capable of completing complex online workflows. This shift reflects a broader trend: embedding automation directly into the core interface of user interactions with the internet. While the potential for increased productivity is huge, the challenges are just as serious, including how to break through deep-rooted anti-robot mechanisms and how to ensure safe, reliable, and responsible use.

In the short term, increased agents' reasoning ability, faster speed, closer integration with existing services, and advances in distributed networks may gradually improve reliability. In the long run, we may see the gradual implementation of “agent-friendly” standards in scenarios where automation benefits both service providers and users. However, this shift will not be uniform: in automation-friendly environments such as DeFi, adoption will be faster; in Web2 platforms that rely heavily on user interaction control, acceptance will be slower.

In the future, technology companies' competition will increasingly focus on the following aspects: how well their agents can navigate under real-world restrictions, whether they can be safely integrated into key workflows, and whether they can deliver results stably in diverse online environments. Whether all of this will eventually reshape the “browser battle” depends not only on technical strength, but on whether it can establish trust, align incentives, and show real value in everyday use.

Twitter:https://twitter.com/BitpushNewsCN

Compare the TG exchange group:https://t.me/BitPushCommunity

Compare TG subscriptions:https://t.me/bitpush