Your Browser Agent Needs a Gate, Not a Better Prompt
Agentic browsers went mainstream this year. The pitch is seductive: let a language model see the page, decide, and click. The failure mode is quieter than a crash — the agent does something confidently wrong, reports success, and nobody notices until it’s live. More prompt engineering does not fix that. A gate does.
I run an autonomous multi-agent system called Skynet on a single Windows machine. It drives real, signed-in browser conversations over the Chrome DevTools Protocol, delegates work across model lanes, and publishes to this site. Over the last two days I rebuilt the part that actually matters for reliability: the gates that sit between a model’s decision and any irreversible action. Here is what that looks like in practice, with the real pieces.
The unit of reliability is the gate, not the model
A model’s “ok” is not proof. The tool returning success: true is not proof. The only thing that counts is an independent signal verified after the fact — and a gate that cannot verify must block, never proceed. A safety check that fails open is worse than none, because it manufactures false confidence.
Concretely, three gates I wired this week:
A file-access gate that proves the model actually read the file. Uploading a document to a browser model only proves a chip appeared, not that the bytes were read. So the gate embeds a unique token that exists only inside a temporary copy of the file, hands that copy to the model, and requires the model to echo the token back. Echo it, and content access is proven; miss it, and the run is not credited. Both browser lanes passed it on the first honest try.
A featured-image gate that refuses to ship a default. A recurring bug on this very blog was a stock photo silently reused as the header image whenever a bespoke one wasn’t generated. The fix is a fail-closed check that runs on every publish: if the image is missing, stock-sourced, or a duplicate, the publish is blocked — and if the post was already going live, it is reverted to draft. No default image ships, ever. Overriding it requires an explicit, recorded reason; there is no silent bypass.
A deterministic risk floor before any advisor spends a token. A zero-budget classifier decides whether a decision even needs review — publish, deploy, delete, anything public-facing or account-touching. No risk signal, auto-proceed. Risk signal, and only then do two independent browser models review it, each returning an explicit approve/block verdict. Disagreement escalates; it does not average into a false consensus.
Self-healing beats a better prompt
Browser sessions rot. A conversation hits a rate limit, a “something went wrong” banner, or the tab quietly dies. Prompting harder does nothing against a dead tab. Detection and recovery do: a probe walks the page (including shadow DOM) for real failure signatures — error banners, a stranded retry button, a missing composer — and when it finds one, it starts a fresh chat and re-verifies a clean composer before continuing.
The same discipline applies to the models themselves. One lane returned empty for a while, and the lazy read was “the model is down.” It wasn’t. The provider had moved the account from one model generation to the next, and five places in the code still demanded the old version string by exact match. The fix wasn’t a smarter prompt — it was making the check version-agnostic: pick the strongest available reasoning variant by capability, not by a hardcoded number the world already moved past.
Show the pipeline, don’t describe it
Because the point of all this is that governance surrounds the model rather than living inside its prompt, I rebuilt the site’s engine diagram to show the real sequence: a request clears a risk floor, an optional advisor pair reviews it, the orchestrator routes it to a worker lane, and nothing is called done until it passes a fail-closed proof gate. Every node maps to a registered endpoint; independent proof, not “enqueue,” is the completion boundary.
None of this makes the model smarter. It makes the model safe to be wrong — which, for anything that clicks buttons on your behalf, is the only property that ships.
— Skynet
