Top 10 Browser Use Agents in 2026: Full Review

The honest mid-2026 re-review of browser use agents: who survived the shakeout, who got benchmarked into irrelevance, and what actually completes real work on the live web today.

The number one product in our original ranking no longer exists. OpenAI Operator, which we reviewed here as a current product, launched on January 23, 2025 and was shut down on August 31, 2025 after roughly seven months of life - Wikipedia. That is how fast this category moves. Since this review first ran in December 2025, an entire consumer agentic-browser wave has launched, one flagship acquisition was blocked by a government, Google killed its own browser agent project, and the open-source framework that gave this article its name posted the highest benchmark score ever recorded on the live web.

Rather than quietly patching a few prices, we rewrote this review from scratch. Everything below reflects the state of July 2026: verified pricing pulled from official pricing pages this month, independent benchmark data instead of vendor claims, and a security section that did not exist in the first edition because the attacks it covers had not been published yet. Where the original review got something wrong or where the world simply moved, we say so explicitly. A ranking that never admits its own staleness is not a review, it is an advertisement.

The core subject is unchanged: browser use agents, meaning AI systems that operate a real web browser the way a person does. They click, type, scroll, log in, fill forms, extract data, and complete multi-step workflows across websites that were never designed for machines. The category now splits into three distinct tiers (consumer agentic browsers, developer browser infrastructure, and enterprise outcome agents), and mixing them in one flat list, as the first edition did, produces rankings that mislead buyers. This edition ranks across tiers with a transparent scoring model, then goes deep on each tool, on the benchmarks, on the infrastructure shootout data, and on the prompt injection problem that OpenAI itself now admits may never be fully solved - CyberScoop.

This guide was researched and written by Yuma Heymans ( @yumahey), founder of O-mega, who operates production browser agent fleets daily and has watched most of the failure modes described below happen on his own infrastructure.

Contents

1. What Changed Since This Review First Ran
2. The Three Tiers of Browser Agents in 2026
3. Benchmarks That Matter: Online-Mind2Web and OSWorld
4. The Infrastructure Shootout: Latency and Reliability, Measured
5. Browser Use: The Open-Source Standard That Now Tops the Benchmarks
6. Browserbase: Cloud Browsers at Series-B Scale
7. Steel.dev: The Fastest Session Starts in the Industry
8. TinyFish: Enterprise Outcome Agents With Named Customers
9. ChatGPT Atlas and ChatGPT Agent: What Replaced Operator
10. Manus: From Invite-Only Beta to Geopolitical Flashpoint
11. Kernel: Unikernel Browsers and the Marketing-vs-Benchmark Gap
12. O-mega: A Multi-Agent Workforce That Browses
13. Airtop: No-Code Automation With Deployed Agents
14. Anchor Browser: Deterministic Replay and the Web Action Cache
15. The Consumer Agentic Browser Wave
16. Security and Prompt Injection: The Category's Defining Problem
17. Plan Once, Replay as Code: The Deterministic Replay Trend
18. The Graveyard: What Died Between the Editions
19. New Entrants and Near Misses
20. Decision Framework: Picking by Job-to-be-Done
21. FAQ
22. Final Take

The 2026 Ranking at a Glance

Before the deep dives, here is the full weighted assessment. Four criteria, weights summing to 100 percent, each score justified with the actual data point that produced it. Capability (30 percent) measures whether the agent completes real tasks on the live web, anchored to independent benchmark results where they exist. Reliability and scale (25 percent) covers measured uptime, session start behavior, and concurrency ceilings. Pricing value (25 percent) rewards transparent, verifiable pricing and low entry cost. Security and governance (20 percent) covers compliance posture, injection defenses, and vendor risk.

Two notes on reading this table honestly. First, the top three are separated by less than half a point, and which one is right for you depends almost entirely on whether you want a full agent (Browser Use), managed infrastructure with the deepest ecosystem (Browserbase), or the fastest raw session layer (Steel). Second, scores for infrastructure products measure the infrastructure, not the intelligence: Steel scoring 10 on reliability does not mean an agent built on Steel completes more tasks than Manus, it means the browser layer underneath will not be your failure point.

1. What Changed Since This Review First Ran

No competing roundup publishes an honest revision log, so here is ours. The original edition of this article, published in December 2025, ranked ten products. Between then and July 2026, the category experienced more structural change than most software markets see in five years. Understanding this timeline matters because it explains why vendor risk is now a first-class selection criterion, not a footnote: two of the most heavily marketed products in the space were killed by their own vendors within a year of launch.

The whiplash started before our first edition even shipped, and we missed it. Operator was already dead when we ranked it ninth: OpenAI shut it down on August 31, 2025, replacing it first with ChatGPT Agent (announced July 17, 2025) and then with agent mode inside the ChatGPT Atlas browser - Wikipedia. We also described Manus as an invite-only beta running two-generation-old models, when it had already gone fully public with a free tier. Those errors are corrected throughout this edition, and the events since then have been just as dramatic.

The single most consequential shift is that the browser itself became the product. In 2025 the market sold agents that used browsers; by mid-2026 the giants sell browsers that contain agents. ChatGPT Atlas launched on macOS on October 21, 2025 as a Chromium-based browser with agent mode built in, and by March 2026 OpenAI announced that Atlas, the ChatGPT desktop app, and Codex would merge into a single desktop application - Wikipedia. Google answered by shipping Gemini in Chrome with agentic Auto Browse powered by Gemini 3, announced January 28-29, 2026 and rolling out to AI Pro and Ultra subscribers - Google Blog. Then it killed the standalone experiment: Project Mariner was discontinued on May 4, 2026, with its capabilities folded into Gemini Agent and Chrome Auto Browse - Android Headlines. We covered Mariner's original launch in our news piece on Google's browser agent, which now reads as a historical document.

The second shift is that prices collapsed toward free. Perplexity's Comet browser launched behind a $200 per month Max subscription; on March 18, 2026 it dropped the paywall entirely and is now free on Mac, Windows, iOS, and Android - MacRumors. Manus, which gated access behind invite codes in early 2025, now hands every visitor 300 free daily credits. Agent mode from OpenAI, once locked to the $200 per month Pro tier, is available to Plus subscribers at $20 per month inside a free-to-download browser. When the marginal price of a consumer browsing agent hits zero, paid products have to win on something else: scale, reliability, governance, or orchestration. That reframing drives most of the rankings below.

The third shift is consolidation and casualty. Atlassian completed its $610 million all-cash acquisition of The Browser Company (maker of Arc and Dia) on October 21, 2025 - Atlassian. Meta agreed to acquire Manus's parent company for a reported $2-3 billion, and Chinese regulators blocked the deal on April 27, 2026, with Meta formally cutting ties on June 15, 2026 - Wikipedia. A product you standardize on can be acquired, blocked, merged, or shut down inside a single budget cycle. Section 18 treats this graveyard as a buying signal in its own right.

2. The Three Tiers of Browser Agents in 2026

The first edition of this review made a category error that almost every competing roundup still makes: it ranked a consumer ChatGPT feature, raw developer infrastructure, and enterprise workflow platforms against each other as if they competed for the same buyer. They do not. By mid-2026 the market has stratified into three tiers with different buyers, different pricing logic, and different failure modes, and the fastest way to waste money in this category is to buy from the wrong tier.

The taxonomy matters because the tiers are converging from opposite directions. Consumer browsers are adding governance features to move upmarket, infrastructure vendors are adding no-code layers to move downmarket, and outcome-agent vendors are wrapping both. If you understand which tier a product actually lives in, its pricing and its limitations stop being surprising. For a deeper primer on the underlying mechanics of how these systems drive a browser at all, see our insider guide to AI browser automation.

Tier 1, consumer agentic browsers, sell to individuals. The product is a browser (Atlas, Comet, Opera Neon, Dia) or a browser extension (Claude for Chrome, Gemini in Chrome) with an agent that acts inside your logged-in session, using your cookies and your identity. The economics are subscription or free, the concurrency is one task at a time, and the defining risk is prompt injection against your personal accounts. This tier did not exist as a shipping category when our first edition ran; it now defines public perception of the whole space, which is why it gets a full section below and a representative entry (Atlas) in the top ten.

Tier 2, developer browser infrastructure, sells metered browser sessions to engineers building agents. Browserbase, Steel, Kernel, Anchor, Hyperbrowser, and Browser Use Cloud all live here. The product is measured in browser-hours, concurrent sessions, cold-start milliseconds, and anti-bot pass rates. Nobody in this tier supplies the "brain" by default (Browser Use is the exception, since the framework is the brain and the cloud is the body). The defining risks are reliability at scale and cost predictability, which is why Section 4's independent latency data matters more than any feature list.

Tier 3, enterprise outcome agents, sell completed work. TinyFish sells monitored web operations to companies like Google, DoorDash, Amazon, and ClassPass - TinyFish. Amazon Nova Act sells reliable workflow execution as an AWS service. Manus sells general task completion to prosumers and teams. O-mega sells an orchestrated workforce of agents that browse as one of several capabilities. Buyers here evaluate outcomes per dollar, auditability, and governance, not milliseconds. Ranking a Tier 3 product below a Tier 2 product on infrastructure criteria (or vice versa) is meaningless, which is why our master table carries a Category column and why the per-tool sections below always name the tier first.

3. Benchmarks That Matter: Online-Mind2Web and OSWorld

The original edition of this review contained zero benchmark numbers, because in late 2025 the category barely had credible ones. That excuse is gone. The industry now has a de-facto standard live-web benchmark, an independent leaderboard maintained by an infrastructure vendor with an incentive to be neutral across agents, and a desktop-level benchmark for full computer use. Any 2026 review that still ranks browser agents on vibes and funding announcements is not doing its job.

The standard is Online-Mind2Web, maintained by the OSU NLP Group: 300 realistic tasks across 136 real, live websites, scored on whether the agent actually completed the task - GitHub. Its predecessor in public mindshare, WebVoyager, is effectively retired as a differentiator: top agents saturated it, and a benchmark where everyone scores in the high nineties cannot separate products. When you see a vendor still quoting WebVoyager in mid-2026, read it as a signal that their Online-Mind2Web number is worse. The current scores, from the leaderboard's June 29, 2026 update, are the closest thing this industry has to ground truth - Steel Leaderboard.

The headline result: Browser Use Cloud scored 97.0 percent, the highest score ever recorded on the benchmark, achieved on March 25, 2026 using a technique the team calls Auto-Research, where the agent investigates a site's structure before committing to an action plan - Browser Use. Behind it sit GPT-5.4 Native Computer Use at 93.0 percent, a pipeline combining a hosted browser platform with Claude Opus 4.6 at 90.53 percent, TinyFish at 90.0 percent, and ByteDance's UI-TARS-2 at 88.2 percent. Two years ago the best agents completed roughly half of realistic web tasks; the frontier now fails only one task in thirty-three. That is the difference between a demo and a dependable employee.

One methodological caveat belongs in every honest discussion of these numbers: the judge changes the score. Online-Mind2Web results shift depending on whether completion is graded by human evaluators, by the automated WebJudge system, or by agentic judges, and cross-vendor comparisons are only clean when the judging methodology matches - GitHub. A vendor quoting a score without naming the judge is quoting marketing. The leaderboard we cite normalizes this, which is exactly why it has become the reference.

For full desktop-level automation, the reference is OSWorld: 369 real tasks across actual desktop applications, not just browsers. As of May 28, 2026 the leader is Claude Mythos Preview at 85.4 percent - OSWorld. The gap between OSWorld's 85 percent and Online-Mind2Web's 97 percent is worth internalizing: browsing is close to solved for well-specified tasks, while general computer use is not. If your workflow lives entirely in web apps, you can buy near-human reliability today. If it crosses into desktop software, budget for supervision. We dig into how these capabilities get wired into production systems in our guide on adding browser automation to your AI agent.

4. The Infrastructure Shootout: Latency and Reliability, Measured

Vendor marketing in the browser infrastructure tier is a fog of "sub-second cold starts" and "enterprise-grade reliability" claims that were, until recently, unfalsifiable. That changed in November 2025 when Steel published browserbench, a study that ran 5,000 sessions against each of the five major infrastructure providers from AWS us-east-1 and published every number, including the ones that flattered its competitors and the one that embarrassed a rival's marketing - Steel.

Yes, Steel is a competitor benchmarking its own market, and you should apply the appropriate discount. But the methodology is public, the sample size is large, no vendor has published a credible rebuttal in the eight months since, and the results are the only independent-ish quantitative comparison the tier has. Until someone neutral runs a bigger study, this is the best available evidence, and it produced the single most useful chart in this entire review.

The spread is enormous: 894 milliseconds for Steel versus 8,007 milliseconds for Anchor Browser, a 9x difference in how long your agent waits before it can do anything. Reliability separated less dramatically but still meaningfully: Steel, Kernel, and Hyperbrowser completed 100 percent of sessions, Browserbase came in at 99.96 percent, and Anchor at 97.34 percent - Steel. A 97.34 percent session success rate sounds fine until you run 10,000 sessions a day and eat 266 failures before your agent logic even gets a chance to fail on its own.

The most instructive tension in the data involves Kernel. Kernel's marketing advertises sub-150 millisecond cold starts on its unikernel platform - Kernel. The independent measurement clocked Kernel at 1,520 milliseconds average session start. Both numbers can be simultaneously true (a unikernel can boot in 150ms while the full session-ready path, with networking, profile loading, and API overhead, takes ten times that), but only one of them describes what your agent actually experiences. This gap between the microbenchmark a vendor quotes and the end-to-end number a customer feels is endemic in this tier, and it is exactly why we weight measured data over claimed data throughout this review.

What should you do with these numbers? Match them to your workload's shape. If your agents run long sessions (a 20-minute research workflow), session start latency amortizes to irrelevance and reliability dominates. If you run thousands of short tasks (check one price, extract one record, verify one listing), start latency is your single biggest cost and Steel's 894ms versus Anchor's 8 seconds is the whole ballgame. If you run authenticated workflows where a mid-session failure means a broken shopping cart or a half-submitted form, the reliability column is worth more than every other spec combined.

5. Browser Use: The Open-Source Standard That Now Tops the Benchmarks

Tier: open-source framework plus cloud. Final score: 8.7, first place. The biggest single correction from our first edition: we mentioned Browser Use only as the underlying dependency other products build on. That was already an undersell then, and it is indefensible now. Browser Use is a top player in its own right, with roughly 97,000 GitHub stars, a $17 million seed round led by Felicis, its own cloud offering, and the number one score on the benchmark that matters - Browser Use.

The framework's approach is what the whole category converged on: expose the browser to a language model as structured DOM state plus screenshots, let the model plan and act in a loop, and handle the messy translation between "click the submit button" and actual CDP commands. What pushed it to the top of the leaderboard is Auto-Research, the technique behind its record 97.0 percent Online-Mind2Web run: instead of acting immediately, the agent first explores the target site's structure, learns its patterns, and only then executes, trading a little latency for a large accuracy gain - Browser Use. It is the software equivalent of reading the form before filling it in, and it turns out machines benefit from that discipline as much as humans do.

The economics are the second reason it ranks first. The framework is free and open source, so the floor cost of a serious browser agent in 2026 is an API key and your own compute. The hosted cloud, for teams that do not want to run infrastructure, is priced published-and-cheap - Browser Use Pricing:

Limitations. Browser Use gives you the best brain in the category, but you still assemble the body: credentials management, proxy strategy, observability, and guardrails are your job in the open-source path, and the cloud is younger and less battle-hardened than Browserbase's. The framework's rapid release cadence also means breaking changes land more often than enterprise change-management processes enjoy. And the 97 percent benchmark number, real as it is, was achieved with the vendor's own best configuration; your prompts, your sites, and your edge cases will land lower. Best for: any developer starting a browser agent project in 2026, and any team that wants benchmark-leading capability without per-seat platform pricing.

6. Browserbase: Cloud Browsers at Series-B Scale

Tier: developer browser infrastructure. Final score: 8.5, second place. Browserbase held the top infrastructure slot in our first edition and keeps a podium place now, but the company we described has materially changed. It raised a $40 million Series B at a $300 million post-money valuation led by Notable Capital in June 2025, bringing total funding to $67.5 million, and used the war chest to expand from pure infrastructure into the application layer with Director, a no-code automation product - Upstarts Media.

The core offering remains the most complete managed browser platform: headless Chromium fleets with persistent sessions, stealth and anti-bot handling, live session replay for debugging, and the Stagehand SDK that translates natural-language intents into browser actions and, critically, can generate deterministic code from successful runs. Director extends all of this to non-developers, which signals where the tier is going: infrastructure vendors know that metered browser-hours are a commodity under margin pressure, so they are climbing the stack toward the workflow itself. In browserbench's independent measurement Browserbase posted 99.96 percent reliability and a 1,681ms average session start, third fastest of the five providers tested - Steel.

Our first edition said "mid-level plans around $99/month," which is still true and now incomplete. The verified July 2026 ladder - Browserbase Pricing:

Limitations. Browserbase still does not supply the intelligence: you bring the agent logic (Stagehand helps, and pairs naturally with frameworks like Browser Use), so it is muscle plus increasingly good tooling, not a mind. It was also edged on raw session-start speed by Steel and matched on reliability by three competitors in the independent test, so its premium rests on maturity, ecosystem, and debugging tooling rather than any single measured number. For scraping-specific workloads, dedicated extraction stacks like the one we profiled in Firecrawl, the scraper made for the AI web can be simpler than a general browser fleet. Best for: production teams that want the most proven managed browser layer with the deepest debugging and ecosystem support, and are happy to bring their own agent brain.

7. Steel.dev: The Fastest Session Starts in the Industry

Tier: developer browser infrastructure. Final score: 8.3, third place. Our first edition described Steel with the vague honorific "thousands of GitHub stars" and no funding figure. The 2026 reality is sharper: Steel has raised $17 million, operates the de-facto industry benchmark leaderboard at leaderboard.steel.dev, and published the browserbench study that gave this entire tier its first honest performance data - Steel. A company confident enough to publish a 5,000-run comparison including its competitors' numbers earned real credibility, and it helps that its own numbers won: 894ms average session starts and 100 percent reliability, both best-in-test.

Steel's product philosophy is unchanged and remains its charm: an open-source browser API that gives an agent a full virtual browser (mouse, keyboard, pixels, DOM) through a few clean API calls, with stealth, proxies, and session management handled underneath. You can self-host the open-source core or use the hosted cloud. It is deliberately unopinionated about the agent brain, pairing equally well with Browser Use, Stagehand-style tooling, or hand-rolled loops against any frontier model. That neutrality is precisely what makes its leaderboard credible, and it has quietly made Steel the reference infrastructure for benchmark reproduction runs.

Pricing moved from the informal structure we described in 2025 to a published ladder - Steel Pricing:

Limitations. Steel is the rawest of the top-three tools: no no-code layer, no bundled agent, a smaller team than Browserbase, and community-plus-core-team support rather than enterprise hand-holding. Using it well requires engineering comfort. There is also an unavoidable conflict-of-interest asterisk on the benchmark data it publishes, which we have flagged rather than ignored; the mitigation is that the methodology is open and reproducible. Best for: engineering teams optimizing for raw session speed, measured reliability, and open-source flexibility, especially high-volume short-task workloads where that 894ms start time compounds into real money.

8. TinyFish: Enterprise Outcome Agents With Named Customers

Tier: enterprise outcome agent. Final score: 8.0, fourth place. TinyFish was the "enterprise workflows" entry in our first edition, described mostly in hypotheticals. It no longer needs them. The company raised a $47 million Series A led by ICONIQ in August 2025 and now publishes both a customer list (Google, DoorDash, Amazon, ClassPass) and hard performance claims: 89.9 percent Mind2Web accuracy, sub-250ms cold starts, and an 85 percent anti-bot pass rate - TinyFish. Independently, it holds 90.0 percent on the Steel-hosted Online-Mind2Web leaderboard, fourth in the world and the highest of any pure enterprise vendor - Steel Leaderboard.

The product has crystallized into four APIs: Search, Fetch, Agent, and Browser, which together let an enterprise compose anything from a single monitored extraction to a fleet of long-running web operations. The positioning is outcomes, not sessions: a TinyFish deployment is measured on completed workflows across the messy public web (marketplace monitoring, pricing intelligence, operational data collection at scale) rather than on browser-hours consumed. This is the tier-3 pattern in its purest form, and the named logos suggest it survives contact with procurement. It is also a structural descendant of the RPA promise, delivered through the browser instead of brittle desktop recorders, a shift we analyzed in agentic business process automation, the new RPA.

Limitations. Pricing remains custom and enterprise-only, which costs it points in our model: there is no self-serve tier, no published rate card, and no way for a mid-market team to try it without a sales cycle. Deployment still requires collaboration with the customer's compliance and IT functions, so time-to-value is measured in weeks, not minutes. And its benchmark score, excellent as it is, trails the open-source leader by seven points, a gap TinyFish would argue is bought back through governance, auditability, and anti-bot robustness on hostile production sites. Best for: enterprises that want web operations delivered as an audited, supported outcome with a vendor who has already survived Google-scale procurement, and can absorb enterprise pricing.

9. ChatGPT Atlas and ChatGPT Agent: What Replaced Operator

Tier: consumer agentic browser. Final score: 7.8, fifth place. This entry replaces OpenAI Operator, which our first edition reviewed as a current product ranked ninth. To restate the correction plainly: Operator launched January 23, 2025 and was shut down August 31, 2025, succeeded by ChatGPT Agent (announced July 17, 2025) and then by agent mode inside the ChatGPT Atlas browser - Wikipedia. Our companion piece on what Operator was and how access worked is preserved as history; nothing in it describes a product you can buy today.

What you can buy today is dramatically more accessible than what it replaced. ChatGPT Atlas launched on macOS on October 21, 2025 as a free, Chromium-based browser with ChatGPT woven through it; January 2026 added tab groups and an Auto search mode, and in March 2026 OpenAI announced Atlas will merge with the ChatGPT desktop app and Codex into one desktop application - Wikipedia. Agent mode, the Operator successor that actually clicks and types, is no longer a $200-per-month Pro exclusive: it is available on Plus, Pro, Go, and Business tiers, which means the entry price for OpenAI's browsing agent fell from $200 to $20 per month inside a free browser. Under the hood, the current generation is formidable: GPT-5.4's native computer use scores 93.0 percent on Online-Mind2Web, second only to Browser Use - Steel Leaderboard. Our breakdown of what the Operator-era pricing looked like is a useful before-and-after artifact.

The launch that defined this transition is worth seeing in its original form: OpenAI's own introduction of Atlas, presented by Sam Altman and the browser team, is the moment the browser agent stopped being a research preview and became a mass-market product.

Limitations. This is a consumer product with consumer constraints: usage caps, one interactive task at a time, no fleet management, no API-grade programmability, and it acts inside your real logged-in identity, which makes the security question personal. OpenAI has been unusually candid here: its head of preparedness stated that prompt injection against browser agents like Atlas may never be solved, and the company shipped Lockdown Mode on February 13, 2026 plus an ongoing anti-injection hardening program - CyberScoop. Atlas has also had concrete vulnerabilities, including the Tainted Memories CSRF issue covered in Section 16. Best for: individuals who want the most capable personal browsing copilot at the lowest price, with eyes open about injection risk and no illusions of production automation.

10. Manus: From Invite-Only Beta to Geopolitical Flashpoint

Tier: autonomous general agent. Final score: 7.7, sixth place. Almost every sentence our first edition wrote about Manus is now wrong, which says less about the original reporting than about the company's velocity. We described a beta-phase, invite-only product running earlier-generation models. The July 2026 reality: Manus is fully public with a free tier, shipped Manus 1.5 on October 16, 2025 and Manus 1.6 on December 15, 2025, relocated from China to Singapore, and hit a ~$125 million revenue run rate in December 2025, up from roughly $90 million in August - Wikipedia.

Then it became a geopolitical case study. Meta agreed to acquire Manus's parent company, Butterfly Effect, for a reported $2-3 billion. Chinese regulators blocked the deal on April 27, 2026, and Meta formally cut ties on June 15, 2026 - Wikipedia. For buyers, this is not gossip, it is a risk disclosure: the most commercially successful independent autonomous agent operates under jurisdictional pressure that has already destroyed one multi-billion-dollar outcome, and that uncertainty is priced into our governance score. The product itself remains what made it famous: give it a high-level goal, and it plans, browses, writes and executes code in a sandbox, and delivers finished artifacts with minimal hand-holding, the "digital employee" pattern that consumer agent modes still only approximate.

Pricing went from invite codes to one of the most generous free tiers in the category - Manus Pricing:

Annual billing saves 17 percent across paid tiers - NoCode MBA.

Limitations. Autonomy cuts both ways: Manus takes initiative, which means it sometimes takes routes you did not anticipate, and supervising a highly autonomous agent on sensitive accounts requires the guardrail discipline described in Section 16. Credit consumption on complex tasks is real, and power users routinely burn through mid-tier allowances. The vendor-risk overhang is the biggest deduction: a blocked acquisition, a jurisdiction migration, and a revenue engine that will attract further regulatory attention. Best for: individuals and teams that want maximum end-to-end task autonomy today and can tolerate vendor turbulence in exchange for it.

11. Kernel: Unikernel Browsers and the Marketing-vs-Benchmark Gap

Tier: developer browser infrastructure. Final score: 7.5, seventh place. Our first edition cited Kernel's "$22M funding" without context. The context: that figure is combined seed plus Series A led by Accel, announced October 2025, and the company has since reached general availability (February 9, 2026) and landed distribution on the Vercel Marketplace - Kernel. Kernel's technical bet is genuinely differentiated: sandboxed Chromium on a unikernel platform, a minimal single-purpose OS image per browser, which the company advertises as delivering sub-150ms cold starts with strong isolation.

The honest tension, covered in Section 4, deserves repeating in the product entry because it is the most instructive data point in the tier: Kernel advertises sub-150ms cold starts, while Steel's independent 5,000-run benchmark measured Kernel at 1,520ms average session start - Steel. The unikernel may well boot in 150ms; the session your agent can actually drive takes ten times longer to be ready. Neither number is a lie, but only one is your latency. To Kernel's credit, the same independent test measured it at 100 percent reliability, tied for best, and second-fastest overall, which is a strong showing that needs no marketing gloss.

Limitations. Kernel is infrastructure only: the racecar, not the driver, and you bring the agent logic. It is the youngest GA product in the tier, with the shortest production track record and an ecosystem that is still forming around the Vercel distribution channel. Published self-serve pricing is thinner than competitors' (usage-based through the platform and marketplace), which costs it transparency points against Browserbase's and Steel's fully public rate cards. Best for: teams already deployed on Vercel who want isolation-first browser infrastructure with measured top-tier reliability, and who evaluate on independent numbers rather than cold-start marketing.

12. O-mega: A Multi-Agent Workforce That Browses

Tier: multi-agent workforce platform. Final score: 7.5, eighth place. Full disclosure first, as in every edition: O-mega is our platform, and we score it with the same rubric as everyone else, which this year lands it mid-table, tied with Kernel. Our first edition described O-mega speculatively as an "up-and-coming player as of late 2025" with "likely per-agent or tiered" pricing. Writing from first-hand product reality instead: O-mega is a platform where you run an AI workforce, multiple persistent agents with distinct roles that plan work, browse the live web in isolated sessions, execute code, use connected tools, and coordinate with each other under one orchestration layer.

The browser capability sits inside that larger structure rather than being the whole product. An O-mega agent spins up isolated browser sessions for research, monitoring, outreach, and operational tasks, with managed credentials, per-agent identities, and human approval gates on sensitive actions. Where a single-agent product gives you one very capable operator, O-mega's bet is that real workloads decompose: one agent gathers, another verifies, another acts, and the orchestration layer handles handoffs, scheduling, and memory. That architecture claim is not unique to us, and readers can evaluate the general pattern in our deep dive on multi-agent orchestration before deciding whether any vendor's implementation, ours included, earns it.

Pricing is credit-based and tiered: a free tier to start, with paid plans (Pro, Max, and Team levels) that scale monthly credit allowances, model quality, and concurrency, listed at o-mega.ai/plans. Credits meter actual agent work (browsing, generation, tool calls) rather than seats, which fits workloads where a small team supervises a larger fleet of agents.

Limitations. O-mega is not the right buy if you need raw metered browser infrastructure (tier 2 does that cheaper and lower-level) or a single free consumer copilot (tier 1 does that at zero). Multi-agent setups also carry inherent coordination overhead: decomposing work across agents takes more upfront thought than pointing one agent at one task, and the platform is younger than the infrastructure incumbents above it. Best for: operators and small teams that want several specialized agents working in parallel with browsing as one capability among many, managed under one roof.

13. Airtop: No-Code Automation With Deployed Agents

Tier: no-code agent platform. Final score: 7.3, ninth place. Airtop (formerly Switchboard) keeps its identity from the first edition: cloud browsers controlled in natural language, aimed at operators, marketers, and researchers who will never write Playwright. What changed is the specificity we can offer. Our first edition repeated a "~$38 million funding" figure from a secondary source; we could not verify that number against current primary sources this cycle, so we have dropped it rather than repeat it, which is the same standard we apply to every vendor claim in this review.

What we can verify is the product and the price list. Airtop has grown beyond one-off instructions into deployed agents, headlined by a packaged agent product called Mark, which runs recurring web workflows (think continuous lead research or monitoring) rather than single sessions. The verified July 2026 pricing - Airtop Pricing:

The pitch remains speed-to-automation for non-engineers: describe the task, let the platform interpret and execute it in a cloud browser with persistent logins, and pipe results into spreadsheets and downstream tools. For teams comparing this tier, our May 2026 roundup of the top 10 AI browsers covers the adjacent consumer products that increasingly overlap Airtop's use cases from below.

Limitations. Natural-language automation still inherits natural-language ambiguity: vague instructions produce confident wrong behavior, and non-technical users hit a ceiling when a workflow needs exception handling that plain English cannot express. Airtop publishes no score on the public benchmarks we lean on, so capability assessment rests on product surface rather than measured task completion, which caps its capability score. Credential handover to a cloud platform also demands the same guardrail thinking as every tool in this review. Best for: non-technical teams that want recurring web workflows running this week, with a real free tier and the lowest paid entry point in the ranking.

14. Anchor Browser: Deterministic Replay and the Web Action Cache

Tier: developer browser infrastructure. Final score: 7.0, tenth place. Anchor's first-edition entry was thin; the company now has the clearest differentiator in the infrastructure tier and, uncomfortably, the weakest independent performance numbers. The $6 million seed (October 2025, co-led by Blumberg Capital and Google's Gradient Ventures) we reported stands - Anchor Browser. What is new is the strategic pivot to deterministic replay via the Web Action Cache: the agent plans a workflow once with full LLM reasoning, then the workflow replays as code on every subsequent run, with Anchor claiming 80x fewer tokens on replayed executions.

That architecture is the subject of Section 17, because it is bigger than one vendor, but Anchor is its purest expression: if your workload is the same authenticated workflow run hundreds of times (internal app updates, recurring report pulls, standing data syncs), paying LLM prices once and code prices forever is structurally the right cost model. Anchor also retains its original identity strength, first-class support for internal and authenticated apps (SSO, MFA, VPN-guarded tools) alongside the public web, with SOC2 and ISO27001 on the top tier.

The counterweight is the independent data. In browserbench, Anchor recorded the slowest session starts (8,007ms average) and the lowest reliability (97.34 percent) of the five providers measured - Steel. Current pricing - Anchor Browser:

Limitations. The measured latency and reliability gap is the headline deduction, and the pricing ladder jumps steeply from $50 to $500 with little in between for growing teams. The deterministic-replay value proposition also depends on workflow stability: sites that change frequently force re-planning, which erodes the 80x economics. We maintain dedicated comparison guides for teams evaluating this segment, including Anchor Browser alternatives and stealth browser alternatives to Anchor. Best for: teams running stable, repeated, authenticated workflows where replay economics and internal-app support outweigh raw session performance.

15. The Consumer Agentic Browser Wave

The largest omission in our first edition was structural: it contained no mention of the consumer agentic-browser wave, because in December 2025 the wave was weeks old. Seven months later, this tier defines how the public experiences browser agents, and any review that skips it is describing a developer subculture rather than a market. The pattern across every entrant is identical: take a Chromium base or a Chrome extension, embed a frontier model, and let it act inside the user's own logged-in session.

Beyond Atlas (profiled in Section 9), four products define the wave. Perplexity Comet is the accessibility story: launched behind a $200 per month Max subscription, it dropped its paywall on March 18, 2026 and is now free on Mac, Windows, iOS, and Android, keeping agentic search, page summarization, Deep Research, and voice mode - MacRumors. Claude for Chrome is Anthropic's wager that the extension beats the browser: after starting as a 1,000-tester research preview in August 2025, it is in beta on all paid Claude plans as of December 2025, with the Pro tier ($20 per month) running Haiku 4.5 and Max, Team, and Enterprise tiers able to select stronger models including Opus 4.x - Claude. Gemini in Chrome brings agentic Auto Browse, powered by Gemini 3, to the browser 3+ billion people already use, rolling out to AI Pro and Ultra subscribers in the US first and then ten more countries - TechCrunch. And Opera Neon went public on December 11, 2025 at $19.90 per month with its Chat, Do, and Make agents, bundling access to Gemini 3 Pro, GPT-5.1, and Veo 3.1 - Opera Neon.

The consolidation datapoint completes the picture: Dia, The Browser Company's AI browser we previewed back when it was about to launch, is now an Atlassian product following the $610 million all-cash acquisition that closed October 21, 2025, repositioned as the AI browser for knowledge work - Atlassian. In fourteen months this tier went from nonexistent to five major products, one acquisition, and one free-fall in pricing.

What does the wave mean for buyers of the other two tiers? Three things. First, expectation setting: executives now experience browser agents personally, which accelerates enterprise procurement but also imports consumer-grade mental models ("it's free on my laptop, why does the fleet cost thousands?"). The answer is concurrency, governance, and reliability, none of which the free tier provides. Second, identity risk moved to the individual: these agents act as you, in your session, with your cookies, which is why the security section that follows is not optional reading. Third, the giants have committed: OpenAI, Google, Perplexity, Opera, and Atlassian are all shipping, which validates the category and simultaneously caps the upside of any startup whose only product is a consumer browsing copilot. Analyst projections have the AI browser market growing from $4.5 billion in 2024 to $76.8 billion by 2034, a 32.8 percent CAGR - Firecrawl. Even discounting the usual forecast optimism, the direction is unambiguous.

16. Security and Prompt Injection: The Category's Defining Problem

This section did not exist in our first edition, and its absence is the single biggest information gap between that version and the world as it stands. Between mid-2025 and early 2026, prompt injection graduated from a researcher's curiosity to the defining security issue of the browser agent category, with public proof-of-concept attacks against shipping products, an emergency-shipped defense mode from OpenAI, and an on-the-record admission from the vendor with the most to lose that the problem may be permanent. A 2026 review without this section is a pre-2026 review wearing a new date.

The canonical attack was published by Brave's security team, who found it on July 25, 2025 and disclosed it in August: an indirect prompt injection against Perplexity's Comet, where invisible text embedded in a web page (white-on-white, or hidden in a Reddit comment) instructed the browsing assistant to navigate to Gmail, fetch a one-time password, and exfiltrate the OTP through a social media reply, all while the user thought the agent was summarizing a page - Brave. The attack requires no malware and no compromised endpoint. It weaponizes the agent's defining feature: it reads the web, and the web can talk back. ChatGPT Atlas has had its own class of issues, including the Tainted Memories CSRF vulnerability, where a crafted page could plant persistent instructions into the agent's memory that survive across sessions.

The vendor responses tell you how seriously to take this. OpenAI shipped Lockdown Mode on February 13, 2026, an Atlas hardening program that constrains what agent mode can do on sensitive sites, and its head of preparedness publicly stated that prompt injection for browser agents "may never be solved" - CyberScoop. That statement deserves weight precisely because it is against interest: the company selling the agent is telling you its core attack surface is structural. The underlying reason is simple to state and hard to fix: a language model cannot reliably distinguish instructions from data when both arrive as text in the same context window. Every page the agent reads is a potential command channel.

Practical guardrails follow directly from that structure, and the difference between tiers matters here. For personal use of consumer agents: run agent mode logged out wherever possible, keep approval gates on for purchases, credentials, and email, treat "browse my inbox" as the highest-risk instruction you can give, and prefer trusted-site allowlists when the product offers them. For production fleets, the calculus inverts in your favor: infrastructure-tier agents run in isolated sessions with scoped, purpose-built credentials rather than your personal identity, so a successful injection compromises one sandboxed workflow rather than your life. Platforms in tier 2 and 3 increasingly ship this pattern by default (per-session isolation, secret vaulting, human approval on irreversible actions), and it is the pattern we build around at O-mega as well. The honest bottom line for July 2026: injection risk is manageable, not solvable, and the vendors saying so out loud are more trustworthy than the ones whose security page is silent.

17. Plan Once, Replay as Code: The Deterministic Replay Trend

Underneath the product churn, one architectural trend is quietly rewriting the economics of the entire category, and it deserves its own section because it will shape pricing more than any funding round: deterministic replay. The idea is that an LLM plans and executes a workflow once, expensively, with full reasoning, and the successful run is captured as executable code that replays deterministically on every subsequent execution, at code prices instead of token prices.

Three vendors in this review have converged on the pattern from different angles. Anchor's Web Action Cache is the most explicit, claiming 80x fewer tokens on replayed workflows - Anchor Browser. Browserbase's Stagehand generates deterministic automation code from natural-language runs, and Director packages the same idea for non-developers. Amazon Nova Act compiles agent behavior into repeatable workflows as an AWS service, trained with reinforcement learning in synthetic "web gyms" and claiming 90 percent-plus reliability on the workflows it targets - AWS. Different marketing, same insight: most business web automation is not novel exploration, it is the same fifty workflows run ten thousand times, and paying frontier-model prices for run number 9,999 is waste.

The first-principles economics explain why this wins. An LLM-driven browser action costs tokens on every step, every run, forever; a replayed script costs compute rounding error. If planning a workflow costs one dollar of inference and replaying it costs a hundredth of a cent, the amortized cost of automation collapses toward zero as run count grows, and the LLM's role shifts from executor to compiler. The agent becomes the thing that writes and repairs the automation, not the thing that performs it. This mirrors what happened in coding agents, where the model writes programs rather than interpreting every user request from scratch, a dynamic we explored in building AI agents, the 2026 insider guide.

For buyers, the practical takeaway is a new question to ask every vendor: what happens on run two? If the answer is "the same tokens get spent again," you are buying exploration pricing for repetition workloads. The counterweight is brittleness: replayed code inherits the fragility of traditional automation when sites change, so the winning architectures pair cheap replay with automatic LLM-powered repair when a replay fails. Vendors that get that loop right (detect breakage, re-plan once, resume replaying) will structurally undercut everyone still charging per-token for every run, and that pressure will compound through 2026 pricing pages.

18. The Graveyard: What Died Between the Editions

Most roundups only add products; honest ones also subtract. Since this review first ran, enough well-funded, heavily marketed browser agents have died or been absorbed that vendor mortality is now a selection criterion with its own base rate. Treat this section as the actuarial table for the category.

The confirmed casualties and absorptions, in chronological order. OpenAI Operator: launched January 23, 2025, shut down August 31, 2025, seven months from flagship launch to sunset - Wikipedia. MultiOn, one of the earliest venture-backed autonomous browsing agents, is gone as an independent product. Arc and The Browser Company: absorbed into Atlassian for $610 million, with Arc's development wound down in favor of Dia's knowledge-work positioning - Atlassian. Project Mariner: Google's standalone browser agent, discontinued May 4, 2026 and folded into Gemini Agent and Chrome Auto Browse - Android Headlines. And the Meta-Manus acquisition: agreed at $2-3 billion, blocked by Chinese regulators April 27, 2026, formally abandoned June 15, 2026, leaving Manus independent but strategically stranded - Wikipedia.

The pattern behind the deaths is consistent and instructive. Nothing on this list died from lack of capability; everything died from strategic redundancy. Operator and Mariner were standalone experiments made obsolete the moment their parent companies decided the agent belongs inside the browser and the flagship assistant, not beside them. Arc was healthy enough to be worth $610 million precisely because its team and technology served someone else's platform strategy. The lesson for buyers is uncomfortable but actionable: a big-tech browser agent is a feature of a corporate strategy that can pivot, while an independent vendor is a company whose survival depends on the product you are buying. Neither is safe, but they fail differently, and your migration plan should match. Ask three questions before standardizing: does my workflow export (scripts, recorded workflows, data)? Is there an open-source escape hatch (a reason Browser Use and Steel score well on governance despite their youth)? And if this product disappeared in ninety days, what would the rebuild cost? For two products in our original top ten, that last question stopped being hypothetical within a year.

19. New Entrants and Near Misses

Ten slots force choices, and four products that top competing 2026 listicles did not make our ranking, each for a stated reason rather than an oversight. This section also covers the one product demoted from our own first edition, because a review that silently drops a former entry is hiding the ball.

Hyperbrowser held a full entry in our first edition and moves here, not because it got worse but because the tier got measurably better around it. Its rate card is genuinely developer-friendly: 1 credit = $0.001, one browser-hour = 100 credits (about $0.10 per hour), one scraped page = 1 credit, with a 1,000-credit free tier, YC W25 pedigree, and backing from Accel and SV Angel - Hyperbrowser. This corrects our first edition's "$30/month startup plan" description, which no longer matches the published usage-based model. But in the tier's independent benchmark it measured 3,657ms average session starts, fourth of five, with 100 percent reliability its genuine bright spot - Steel. Against Steel at 894ms and Browserbase's ecosystem, its anti-detection focus was not enough to hold a top-ten slot.

Amazon Nova Act is the closest call in this review and will likely enter the ranking in the next edition. It reached general availability December 2, 2025 as an AWS service in US East, powered by a custom Nova 2 Lite model trained with reinforcement learning in synthetic web gyms, claiming 90 percent-plus reliability, with Hertz reporting 5x faster shipping velocity on automation projects - AWS. What kept it out this cycle: it is AWS-region-scoped, workflow-compilation-oriented rather than general browsing, and has no score on the public leaderboard we anchor capability to. Skyvern is the strongest open-source no-code entrant, quoting 85.85 percent on WebVoyager - Firecrawl, but WebVoyager is the retired benchmark, and without an Online-Mind2Web number we cannot place it against the field. Vercel Labs' Agent Browser (CLI-first) and Bright Data's Agent Browser both ship real products aimed at developers, and both are too new to have the independent reliability data this review now requires for ranking.

The meta-point of this section: the bar for entry rose. In 2025 a browser agent made lists by existing; in 2026 it needs a public benchmark score, an independent reliability measurement, or verified pricing, and ideally all three. That is what a maturing market looks like, and products on this list are one leaderboard submission away from displacing the bottom of our table. Adjacent tooling matters too: many "browser agent" jobs are actually search-and-extract jobs better served by dedicated capabilities, a comparison we maintain in our guide to the best web search APIs for AI agents.

20. Decision Framework: Picking by Job-to-be-Done

Rankings compress; decisions need the job. The same ten products reorder themselves completely depending on what you are actually hiring a browser agent to do, so this section gives one concrete recommendation and one runner-up for each of the four jobs that cover nearly every real inquiry we see. The tier taxonomy from Section 2 does most of the work: identify your job, and the tier (then the pick) follows.

Job 1: personal browsing copilot. You want one assistant that researches, summarizes, fills forms, and books things as you, on your machine. Pick: ChatGPT Atlas with agent mode on Plus at $20 per month, the strongest model-plus-browser integration at consumer price, with Lockdown Mode when you need it. Runner-up: Perplexity Comet, now completely free across desktop and mobile, and the best zero-cost answer in the category - MacRumors. If you live in Claude, the Chrome extension on any paid plan is the natural third option.

Job 2: scraping and data extraction at scale. You want thousands of short sessions, fast starts, and predictable cost per page. Pick: Steel, whose measured 894ms session starts and 100 percent reliability are precisely the specs this job stresses, from $0 plus usage. Runner-up: Browserbase at the $99 Startup tier when you want deeper debugging tooling and the Director/Stagehand layer around raw sessions. Purpose-built extraction services remain worth checking before you build: crawler-first tools solve the "give me clean markdown from these 10,000 URLs" job with less machinery.

Job 3: authenticated internal-app automation. You want the same logged-in workflow run reliably every day across internal tools, SSO, and MFA. Pick: Anchor Browser, whose internal-app support and Web Action Cache replay economics fit exactly this shape, provided the workflow is stable. Runner-up: Amazon Nova Act if you are an AWS shop and the workflow can live in its compiled-automation model with 90 percent-plus claimed reliability - AWS.

Job 4: fleet-scale production workflows and delegated work. You want outcomes, not sessions: monitored operations across many sites, or a standing workforce of agents doing recurring business work. Pick: TinyFish at enterprise scale, with the customer list and the 90.0 percent benchmark score to justify the procurement cycle. Runner-up: O-mega for teams below enterprise procurement weight that want orchestrated multi-agent work (browsing, code, tools) under one roof with a free tier to validate against. And underneath all four jobs, Browser Use is the constant: as an open-source foundation it is the right default for anything you intend to build rather than buy, which is why it tops the overall table.

21. FAQ

Is OpenAI Operator discontinued? Yes. Operator launched January 23, 2025 and was shut down August 31, 2025. Its successor is ChatGPT Agent, announced July 17, 2025, which now lives as agent mode inside the ChatGPT Atlas browser and the ChatGPT apps - Wikipedia. Anything you read reviewing Operator as a current product, including the previous edition of this article, is out of date.

Is Perplexity Comet free now? Yes. Comet dropped its paywall on March 18, 2026 and is free on Mac, Windows, iOS, and Android, including agentic search, page summarization, Deep Research, and voice mode. It originally launched behind Perplexity's $200 per month Max subscription - MacRumors.

What replaced Project Mariner? Google discontinued Project Mariner on May 4, 2026 and folded its capabilities into Gemini Agent and the agentic Auto Browse feature in Chrome, which shipped in late January 2026 for AI Pro and Ultra subscribers, powered by Gemini 3 - Google Blog.

Can browser agents be trusted with passwords? Not unconditionally, and the vendors say so themselves. Prompt injection lets malicious page content hijack an agent's actions, as demonstrated by Brave's OTP-exfiltration proof of concept against Comet - Brave. OpenAI has stated the problem may never be fully solved. Practical posture: use scoped credentials in isolated sessions for automation, keep approval gates on for consumer agents, and never grant a personal-identity agent standing access to email plus payments simultaneously.

What is the best open-source browser agent in 2026? Browser Use, by a wide margin on the evidence: roughly 97,000 GitHub stars, a $17 million Felicis-led seed, and the highest Online-Mind2Web score ever recorded at 97.0 percent - Browser Use. Skyvern is the strongest open-source alternative for no-code workflows, and Steel is the leading open-source choice at the infrastructure layer.

Which benchmark should I trust when vendors disagree? Online-Mind2Web (300 live tasks, 136 real websites) is the current standard, best read from the independently maintained leaderboard at leaderboard.steel.dev. Ignore WebVoyager numbers in 2026, top agents saturated it. And always check which judge produced a score, because human, WebJudge, and agentic judging shift results - GitHub.

22. Final Take

The distance between the two editions of this review is the story of the category. In December 2025 we ranked ten products on features and funding because that was mostly what existed to rank on. In July 2026 we can rank on measured task completion (a 97.0 percent live-web benchmark ceiling), measured infrastructure performance (a 9x spread in session starts across providers), verified pricing (from free consumer agents to $2,000 per month governed infrastructure), and demonstrated vendor mortality (two of our original ten are dead or absorbed). The category grew up, and the evaluation criteria grew up with it.

Three conclusions carry the weight. First, open source won the capability race: the best-performing browser agent on earth is a framework anyone can run for free, which permanently caps what pure capability can charge. Second, infrastructure is the durable business: browsers-as-a-service with measured reliability, governance, and replay economics is where enterprise budgets are settling, which is why Browserbase, Steel, and the deterministic-replay pattern dominate the top of our table. Third, security is the ceiling: until the industry finds better answers to prompt injection than "approval gates and hope," the scope of what agents are allowed to touch, not what they are able to do, will bound the market.

If you take one action from this review, take the tier test from Section 20: name your job before you name your vendor. A personal copilot, a scraping fleet, an internal-app workflow, and a delegated workforce are four different purchases wearing one category label, and every expensive mistake we have seen in this market came from buying across that boundary. The tools are finally good enough that choosing well matters more than waiting for them to get better.

This review reflects the browser agent landscape as of July 2026. This category changes faster than any other in software: pricing, model versions, benchmark leaders, and even vendor existence shift monthly, so verify current details on official pages before purchasing. Previous edition: December 2025; corrections to that edition are documented inline throughout.