I scrolled Hacker News this morning and the front page was basically one topic wearing four different hats. An “autoscaling” browser agent near the top. Yamak a few slots down. Two separate AI Browser Agent Leaderboard threads. Different names, different repos, and underneath almost all of them sat the same architecture: a process running somewhere else that reaches into a browser over remote CDP.

Once you notice the pattern you can’t stop seeing it.

The shape of it

The setup goes like this. You stand up a server, usually a cheap VPS because that’s what the tutorial told you to rent. That server either launches its own Chrome with --remote-debugging-port flipped on, or it connects back to the Chrome on your laptop through a relay tunnel. Then the agent code talks to that browser over the Chrome DevTools Protocol, clicking and typing and scraping the DOM from a distance.

It’s a clever trick and it demos beautifully. CDP is a genuinely powerful protocol, and driving a real Chrome instead of a headless clone means you get real rendering, real fonts, real everything. So the leaderboard numbers look great.

Then you try to actually live inside the thing.

What falls apart the moment you use it

Navigate to a new page and the CDP target you were attached to can go stale, so the agent is suddenly holding a handle to a tab that no longer exists. Restart Chrome and the debugging session is gone. Close the laptop lid, hop onto hotel wifi, and the relay tunnel drops somewhere between your machine and the VPS, which means the agent that was halfway through booking something is now talking to nobody. Because the browser and the brain live in two different places connected by a string, anything that jostles the string breaks the whole apparatus, and you spend more time babysitting the connection than doing the task you wanted done.

I wrote about the server side of this a while back in Every New Browser Agent Needs a Server. Why?, and the relay fragility is the part that keeps getting hand-waved in the demos.

An open port is an open door

Here’s the part that bugs me more than the flakiness.

--remote-debugging-port doesn’t ask for a password. It never has. Whoever can reach that port gets to drive your browser: read every cookie, open your authenticated tabs, exfiltrate session tokens, act as you. The Chrome team has warned about this for years, and yet half these agents cheerfully tell you to bind it and, in more than a few tutorials, forward it so the VPS can see it. On a laptop behind NAT that’s already sketchy. On a box with a public IP it’s a loaded gun pointed at your own logins, and the fact that nobody has robbed you yet is not the same thing as the door being locked.

Martin Fowler called email the nerve center of his life. Your logged-in browser is arguably worse, because it holds the email and the bank and the cloud console, all pre-authenticated, all reachable through one debugging port you opened for a productivity hack.

No tunnel to lose in the first place

This is why I keep coming back to running the agent inside Chrome instead of yelling at it from across a socket.

Dassi lives in the browser’s side panel. It’s a Chrome extension, so it executes in the same process context as the page you’re already looking at. There’s no VPS in the loop, no --remote-debugging-port, no relay tunnel to reconnect after your wifi hiccups. When you navigate, the agent navigates with you, because it isn’t attached to a target over the wire, it just is where the tab is. And it inherits the session you already have, so the Gmail you’re logged into is the Gmail it works in.

The security math changes too. Nothing is listening on a port. Your data doesn’t take a round trip through a rented Linux box before coming back. It reads what you can see and acts where you already are, which is the whole reason browser extensions exist. If you want the mechanics of the different connection styles laid out, I did that in Three Ways AI Agents Connect to Your Browser. You can grab Dassi from the Chrome Web Store if you’d rather just try it.

So when the next leaderboard post hits the front page, check where the browser actually runs before you cheer for the accuracy score. The number is measured in a lab with a stable tunnel. Your Tuesday afternoon is not a lab.