Bit surprised nobody's mentioned the security side. The V8 isolate guards the wrong half of this imo. It stops the agent's code from escaping the sandbox, but the risky part of a browser agent isn't code escaping, it's that it reads untrusted pages and then acts on them. A prompt injection on a page doesn't need to break out of V8, it just tells the agent to use its normal tools to do something you didn't intend. So the isolate bounds what it can run, not what it can be talked into doing. How does Kitesurf scope that part, ie what can the agent actually reach and send after it loads a hostile page?