Let an agent use the browser

An agent in a Wrangl chat can use a browser tab by itself. It can open your app, click through it, fill in a form, and check the result. You see every step in a visible tab. Wrangl asks you before the agent does something risky, and you can stop it at any time.

Watch the agent work

When the agent opens its first page, Wrangl splits the pane you are working in and puts the agent's browser tab on the right. Your cursor stays in the chat. Later pages from the same chat open in that same pane.

The agent's tab has an Agent label. While the agent uses the browser, the chat shows a bar that reads "The agent is using the browser."

The page in an agent tab is covered by a light grid of colored pixels, so you can tell at a glance that an agent drives it. Move your pointer over the page and a clear circle follows it, so you can read the part you point at. The grid doesn't block clicks, and it doesn't show up in the agent's screenshots. If your system is set to reduce motion, the grid stays still.

The agent works only in tabs that it opened. It can't see or control the browser tabs that you opened.

Open sites

By default, the agent opens public sites and devices on your local network without asking you. Risky actions such as payments, uploads and downloads still ask by default, unless you pre-approve them in the browser settings. Passwords follow their own setting.

To be asked before the agent opens each new site, turn on Ask before opening new sites in the browser settings. See Browser rules. Wrangl then asks you the first time the agent wants to open a site in a chat. The prompt reads Allow the agent to open this site? and names the agent and the site, for example "Claude wants to open https://example.com in the agent browser."

Even with that setting on, some sites never ask:

• Local addresses such as localhost, so the agent can test your dev server.
• Sites on your Allowed sites list. See Browser rules.

Choose one:

• Allow for this session lets the agent open that site for the rest of this chat's agent session. If you select Stop, Wrangl takes the session's site access back, so the agent asks again after your next message. See Stop the agent.
• Always allow for this project adds the site to the project's Allowed sites list.
• Deny stops the request. The agent gets an error. If it tries again later, Wrangl asks again.

The prompt shows up in the chat as a card, and at the top of the agent's browser tab when you are looking at that tab. You can also answer it from the phone app or the web version. If you don't answer within 2 minutes, Wrangl denies the request. If no one can answer at all, the agent is told right away.

Open files on your computer

The agent can open local pages with a file:// address, for example an HTML page it just built.

• Files inside the project folder open without asking. Links from one project file to another work too.
• For a file outside the project, Wrangl asks Allow the agent to open this file? and shows the file name and its full path. The options are Allow once and Deny.
• Sensitive files, such as keys and other secrets, are always refused, and so are folders and files on network shares.

If a project folder covers your whole home folder, Wrangl treats it as too broad, so files in it ask like files outside the project.

Risky actions

Some actions still ask even on a site you allowed, unless you pre-approve them:

• Submitting payment details, including "Place order" buttons and card fields.
• Uploading a file.
• Keeping a download.
• Sending data from a page to a different site.

For these, the options are Allow once and Deny. When the agent browses logged out, prompts for eligible actions also offer Always allow on this site for this project. With the shared agent profile, and for some actions even when logged out, they offer only Allow once and Deny. You can pre-approve uploads, downloads, and passwords in the browser settings. Payment forms always ask on the shared agent profile.

Submitting a password doesn't ask by default, so the agent can sign in to sites for you. To be asked first, turn on Ask before an agent submits a password in the browser settings.

Stop the agent

Select Stop on the bar in the chat, or the stop button on the agent's browser tab. The agent's next browser action is refused, and any wait it is running ends. The bar then reads "Browsing stopped until your next message." When you send the agent a new message, it can use the browser again, but sites you allowed only for the session need your approval again.

You can also close the agent's browser tab. The agent loses control of that tab, but it can open a new one. When the agent session ends, Wrangl closes the agent's browser tabs.

Logins

Agents don't use your own logins. They have their own browser profile, separate from the tabs you open.

• By default, every project shares one agent profile. When the agent signs in to a site, it stays signed in in later chats and other projects. Wrangl never clears it by itself.
• To keep a project separate, turn on Browse logged out in this project. The agent then starts logged out in every chat, and everything it saved is deleted when the chat ends.

To sign the agent out of every site, select Clear agent profile in the browser settings. Wrangl asks you to confirm and closes the agent tabs that use the shared profile.

On macOS, the shared agent profile needs macOS 14 or later. On older versions, agents always browse logged out.

Browser rules

There are two places to set what agents may do in the browser. Changes in both save as you make them.

In Application Preferences, open the Browser tab. It applies to every project:

• Shared agent profile turns the shared agent profile on or off. Off: agents always browse logged out.
• Ask before opening new sites. Off by default: agents open public sites and devices on your local network without asking.
• Ask before an agent submits a password.
• Clear agent profile deletes the agent's logins and site data.
• Pre-approved actions in every project lists actions the agent may take on a site without asking, when it uses the shared profile.

In a project's settings, open the Browser tab. It applies to that project only:

• Browse logged out in this project.
• Allowed sites lists sites the agent opens without asking when Ask before opening new sites is on. Use https://*.example.com to include every subdomain.
• Pre-approved actions lists actions the agent may take on a site without asking, when it browses logged out in this project.

You can read these settings from the phone app and the web version, but you can change them only in the desktop app.

What the agent can do

In its own browser tabs, the agent can:

• Open http and https addresses, and file:// pages as described in Open files on your computer. Other kinds of addresses, and a few local addresses, are refused.
• Go back, go forward, and reload.
• Read the page's structure, its buttons, links, fields, and text, and read long text in parts. This includes frames and the inside of web components.
• Click, fill in fields, type, press keys, scroll, hover, pick an option in a list, check and uncheck boxes, and drag.
• Wait for a set time or until something appears on the page.
• Answer page dialogs, pick a file for an upload, and keep downloads.
• Open, list, switch between, and close its own tabs, including popups.
• Take a screenshot of the page.
• Read the page's console messages.

Pages in agent tabs can't use your camera, microphone, or location.

Differences between Windows, macOS, and Linux

On Windows, the agent's clicks are real mouse clicks, and it can read the page's network requests.

On macOS and Linux:

• Clicks and keys come from a script inside the page, not from the mouse and keyboard. Some pages ignore input like this.
• The agent can't read inside a frame that comes from a different site.
• On macOS, the agent can't read network requests.

On Linux, the agent browser needs WebKitGTK 2.40 or later. Debian 12, Ubuntu 24.04, and an updated Ubuntu 22.04 have it.