Skip to content
Get in touch
Menu
Field Guide · level 4 · Agents

What should you let an agent do in a web browser?

Let it read and fill in. Never let it pay, change settings or type a password.

5 min · try it 10 min · as of Oct 2026
Bring this to your team · AI implementationSet your team's allowed sites and approvals, with my help. Get in touch
01

Any page can hide orders

It opens pages and clicks for you. Any page can hide orders.

02

Three kinds of browser

Your own has your logins. A built-in one is kept apart. A cloud one runs on the vendor's computers, even with your laptop closed.

03

Yes, almost, never

Yes: read, compare, take notes. A form? Up to the last step; you check and submit. Never: payments, settings, passwords.

04

Only the sites it needs

List the sites the task needs, with approvals on. Gemini picks its own sites; Google describes no list you set.

05

You type the password

At a sign-in, take over and type it on the site yourself. Never into the chat.

06

Watch it, then stop it

Watch the first runs. When it wanders off the task, stop it, then check what it touched.

Try it · 10 minutes · on your own work

Run one public-sites job

Public sites only.

  1. Pick three suppliers' opening hours or return policies.1 min
  2. Brief it with the three sites and the limits below.3 min
  3. Run it with approvals on, and watch.4 min
  4. Note every point where it asked, or should have.2 min

Copy this into your assistant, then fill in the three sites

Find the opening hours (or the return policy) on these three sites:
1.
2.
3.
Give me a table with a link to each page.
No other sites, no sign-ins, submit nothing.

Good looks likeA table with three links, each fact on its own page, and nothing signed in to or submitted.

In your assistant · as of Oct 2026 · Claude, ChatGPT, Gemini

Set it up in your assistant

Menus move often. Missing something? Usually a rollout, your plan, your country or an admin setting.

My pickClaude first, ChatGPT second, Gemini third. Claude makes the careful start easy; I'd use Opus 5.5 at High. ChatGPT wins for signed-in sites.

Passwords, security codes and card details: you type them into the site yourself, never into the chat.

Claude

Claude in Chrome uses your own Chrome and logins. The desktop app has a built-in browser, kept apart.

Pick
SettingsthenCoworkthenPreferred browser

Choose the built-in browser.

Brake
Manually approveAutomatically approveSkip all approvals

The Chrome side panel starts on Automatically approve: change it. Then Allow this time only, step by step.

Stop
Stop the task

If something feels off, stop it (Anthropic's advice).

Both on Pro and up; on Enterprise, an owner turns the built-in browser on. Claude in Chrome refuses purchases.

ChatGPT

Work's cloud browser runs on OpenAI's computers. The extension uses your own browser.

Sites
SettingsthenCloud browser

Keep Always ask. OpenAI calls Always allow “not recommended”. Allow or block single sites.

Sign in
Secure form

OpenAI says the model cannot see what you type there.

Pay
Say nothenDo it yourself

Before a booking or payment it asks in chat.

The cloud browser is on Plus and up, not Free or Go. The extension's site lists: Settings, Computer Use, Manage.

Gemini

Auto browse in Gemini in Chrome. Tasks use your Chrome or a remote browser.

Start
Ask GeminithenStart Task

Read its plan first. Gemini picks the sites.

Sign in
Take over task

Type it on the page, never in the task. The same for payments.

Stop
Stop

To switch it off: Chrome settings, AI innovations, Gemini in Chrome, Let Gemini browse for you.

Google AI Pro or Ultra on a personal account. Auto browse: US and English only. Tasks: not in the EEA, Nigeria, Switzerland or the UK.

Quick check · three questions

Did it stick?

  1. 1The agent reaches a sign-in page. What do you do?

    The answer: B Type it on the site yourself. OpenAI and Google both say never in the chat.

  2. 2Which Claude in Chrome mode asks before every action?

    The answer: C It asks before each action. The side panel starts on Automatically approve, so change it.

  3. 3The agent opens a site you never listed. What next?

    The answer: A An unlisted site is a warning sign. Stop it, then check what it touched.
0 of 3 answered
“The risk is not zero”Side note
Anthropic says it of its own browser safeguards. So: listed sites, approvals on, passwords typed by you, and the first runs watched.
Clear old loginsSide note
Clear saved logins you no longer need. ChatGPT: Settings, Cloud browser, Browser data. Gemini: delete remote browser data.
Which modelSide note
In Claude, I use Opus 5.5 at High for browser work. OpenAI calls GPT-6 Astra the world's best computer use model: that is its own claim.
Sources, checked 16 Oct 2026Source

Product details as of Oct 2026, each checked on the vendor's own page on 16 Oct 2026. Recheck by 16 Nov 2026. The example in the pictures is made up for this lesson.

Free kitThe Agent PlaybookBring this to your teamAI implementation · Get in touchBack to level 4, Agents

Let it read and fill in. Never let it pay, change settings or type a password.

Next lesson · 15 minHow can AI help with your inbox without sending the wrong thing?