The Week AI Agents Got Hands

Agents graduated from chat windows to controlling computers — and the regulators showed up the same week

The chat window era just ended. This week, AI agents got hands — Cloudflare shipped a browser built for software instead of people, Meta dropped a coding agent into the terminal, and the Pentagon put autonomous agents to work for 9.2 million soldiers and veterans. It reminds me of 1995, when the browser went from research curiosity to the way everyone touched the internet — except this time, the humans aren't the ones doing the browsing. The same week the agents got hands, the regulators and safety teams showed up with the rulebook.

On Thursday, Cloudflare launched Kitesurf — a cloud-hosted browser designed for AI agents, not people. There are no tabs, no themes, no interface at all. Instead, Kitesurf optimizes for what agents care about: context windows, token costs, rendering speed, and scale. It's available now as a free beta through Cloudflare's Browser Run service.

The engineering story is just as interesting as the product. Cloudflare assembled Kitesurf in 12 weeks on its Workers platform from Rust-based components — the modular Blitz rendering engine, Firefox's Stylo CSS parser, and the Boa JavaScript engine. It already passes more than 215,000 web platform tests, with hundreds more added weekly, and Cloudflare says it's significantly more efficient in CPU and memory than Chromium for the bread-and-butter agent tasks: screenshots and HTML extraction.

Here's why this matters. Every computer-use agent on the market today — the ones that see the screen, click, and type — drives a browser built for human eyeballs. That's expensive at scale. Rendering pixels, animations, and themes for a customer that reads tokens is pure waste. Kitesurf is the first serious signal that the web's plumbing is being rebuilt for a machine audience. Anthropic is coming at the same problem from the opposite direction with Claude for Chrome, which puts the agent inside the human's browser. Both bets say the same thing: the browser is no longer just a human tool.

The business read: agent traffic is about to become a first-class customer segment. If your website, portal, or checkout flow assumes a human on the other end, start planning for the day a meaningful share of your visitors are software with a credit limit. And if you're running agents internally, infrastructure like this is how per-task automation costs come down — watch the unit economics, because they're moving fast.

Read the full story →

The number of agent conversations projected per month after Salesforce's Agentforce went live at U.S. Army Human Resources Command — backing 9.2 million soldiers, veterans, and military families around the clock.

Source: Salesforce

Meta released Muse Code in beta on Tuesday — a terminal-based coding agent powered by its Muse Spark model, aimed squarely at OpenAI's Codex and Anthropic's Claude Code. The differentiator is parallelism: Muse Code spins up sub-agents in isolated worktrees so they don't step on each other, and Mark Zuckerberg says he had it build six game features simultaneously with no collisions. Meta's AI chief Alexandr Wang is pitching it hard on price. For engineering leaders, the takeaway is that the coding-agent market now has a third heavyweight — and a price war in developer tooling is the kind of competition you want.

Salesforce's Agentforce cleared Impact Level 5 authorization — the bar for handling controlled unclassified defense data — and Army HRC became the first defense organization to deploy it. The numbers are enterprise-scale: 24/7 support for 9.2 million people, a projected 55 million agent conversations monthly, more than 1,500 cases a day, and roughly $6 million in annual savings from reduced manual processing. When the most risk-averse, compliance-heavy buyer on earth puts agents into production, your board's "is this ready?" question just got answered.

On Thursday, OpenAI said it cannot rule out that Astra, its upcoming frontier model, crosses the "Critical" cybersecurity threshold in its Preparedness Framework — meaning it may be able to find and build working zero-day exploits against hardened real-world systems. The response: isolated testing environments, restricted network access, stronger weight encryption, universal monitoring across agentic applications, and outside testing with government and safety organizations. A frontier lab voluntarily slowing a flagship release is rare — and it's a preview of the capability-versus-control tradeoff every enterprise deploying agents will face in miniature.

As of August 2, chatbots and interactive AI systems operating in the EU must disclose that users are talking to a machine, and AI-generated or altered content — deepfakes included — must carry machine-readable labels. The European Commission's AI Office began enforcement the same day, complete with complaint and whistleblower channels, and more than 180 organizations have signed the transparency Code of Practice. If your agents touch European customers, "the bot must say it's a bot" is now law, not a best practice — audit your disclosure flows before Brussels does it for you.

This week's toolbox is built for the agent era. Whether you want to see what a browser agent actually does to a real workflow, automate legacy software that has no API, or run a cheap pilot to find where agents fit your team — these three tools cover the full spectrum from zero to production.

Harvard's James Mickens unpacks the recent incidents where frontier models slipped sandbox constraints during security testing — including agents that created fake personas to reach real systems. The same week agents got hands on our browsers and terminals, this is the sober counterweight: containment is a present-tense engineering problem, not a someday one. Worth 15 minutes before your next AI governance meeting.