BrowserSkill: agents that use your logged-in browser

Tencent shipped a new extension build of BrowserSkill today, and the pitch is the part you should read twice: it lets an AI agent use your real, logged-in browser instead of a clean automation profile. No test accounts, no re-auth, no fighting a login wall. That is genuinely useful, and it is also the single largest blast radius you can hand an agent on a laptop.

What actually happened

BrowserSkill is a CLI plus a Chrome/Edge extension, MIT-licensed on GitHub under Tencent's org. The repo went up June 22 and sits at roughly 2,400 stars; the newest extension release, ext-v0.3.0, landed September 16 with cross-frame coordinate and screenshot fixes.

The architecture is four hops and no cloud: your agent harness shells out to a bsk command, the CLI talks to a local daemon over IPC, and the daemon reaches the browser extension over a WebSocket. Because the interface is a shell command, it works with anything that can run one — the README lists Cursor, Claude Code, Codex, OpenClaw, CodeBuddy, WorkBuddy, Pi, Hermes Agent and DeepSeek Harness. Install is a curl or irm one-liner, the extension comes from the Chrome Web Store or Edge Add-ons, and bsk install-skill wires it into a supported harness.

Work happens in a dedicated Agent Window so your own tabs stay yours. The extension borrows an existing tab only when explicitly asked and, by default, only with your approval — the README is clear that borrowing requires approval and that the automation settings are configurable. There is human-in-the-loop handling for CAPTCHAs, logins and confirmations, plus full-page screenshots. macOS, Linux and Windows x64; Chrome, Edge and Chromium-based browsers, with Firefox planned.

Why a logged-in browser agent matters for your business

"Reuses your login state" is the feature and the vulnerability. Browser automation has always been annoying precisely because the account boundary was doing its job. Remove it and the agent's reach is not "the site you asked about" — it is every session in that profile. For most operators that profile holds the Shopify admin, the Stripe dashboard, Google Workspace, the payroll portal and the bank. An agent that mis-parses a page and clicks the wrong button does not get a staging environment.

Run it in a profile you built for it. The Agent Window is task isolation, not credential isolation. Make a separate Chrome profile, sign in only to what the job needs, and point BrowserSkill at that. It costs ten minutes and converts "the agent can do anything I can do" into a scoped permission set. We have made the same argument about browser agents that bypass extension controls — the pattern repeats because the browser is where every credential you own already lives.

Leave the approval prompt on. The default asks before borrowing a tab. That default is the control. Anyone who turns it off for convenience has removed the only thing standing between a prompt-injected page and an authenticated click.

The portability is real, though. A shell-callable CLI under MIT means your browser step is not welded to one vendor's agent. That is the right shape: the capability lives in a tool you install, not in a feature your model provider can reprice or retire. Compare that to a proprietary browser mode that ships and sunsets on someone else's schedule.

Sources: Tencent/BrowserSkill on GitHub, BrowserSkill releases.