top of page
logo
SUBSCRIBE

Any Agent Plugs In: Building ABE as an Open Browser for Every AI

Writer: Andrew C. Stephens, D.Tech.
Andrew C. Stephens, D.Tech.
2 days ago
9 min read

Why the AI-Browser Environment should start as an open standard, and how agents from any AI company can work inside it

In my first post, "The Website is Dead. Long Live the Web.", I described a browser that does not fetch a page. It builds one, for you, in real time. I called the idea the AI-Browser Environment, or ABE.

That raises a fair question: whose artificial intelligence (AI) runs it?

In the first post, the AI model (I called it the Constellation) belonged to each browser company. That made sense as a story about competition. But the more I worked through how to actually build ABE, the clearer one change became. The model should be your pick, not the browser company's. And every other part should connect through open, shared rules, so an AI agent from any company can plug in without a special deal.

Think of the outlet in your wall. You do not need a different outlet for every brand of lamp. One standard plug, and anything works. That is what I want for AI in the browser. What follows is a design proposal, not a product announcement.

Open Standard First, Browser Second

The tempting move is to start by building a new browser on top of Chromium, the open-source project behind Google Chrome. Vivaldi, for example, took that route.

The catch is upkeep. Chromium releases a new major version every four or eight weeks, depending on the release track. Vivaldi's lead engineer has written that keeping up with a lot of custom changes takes "at least two full teams for upgrades and development," and that a single update step "can take several workdays." That is a heavy lift before you know anyone wants the product.

So I would flip the order:

  1. Publish ABE as an open specification, a public rulebook anyone can build on.

  2. Ship the first version as a browser extension plus a small desktop app that works with any AI model.

  3. Build a full browser only after a real pilot proves people want it.

An extension reaches people who already use Chrome, Edge, Brave, or Opera, without asking them to switch. The desktop app can keep your private data and a local AI model on your own computer. And if the standard comes first, no single company owns it.

*What this means for you: you would not have to switch browsers to try ABE, and no one company would control the rules.*

The Five Layers, in Plain Terms

Here are the five layers from the first post, rebuilt with open parts.

  • The Galaxy (the content). Publishers, businesses, and creators offer their content in organized pieces, each tagged with who it is for and the license terms for using it. The Galaxy never stores your personal data.

  • 42 (the neutral index). A public directory of what exists, who owns it, and who is allowed to use it. It lists. It never ranks. It also should not learn who is asking, so it cannot quietly build a profile of you.

  • The Constellation (the AI model). This is the layer that changes. Instead of one company's model, it becomes a switchboard that connects to whichever model you choose.

  • The Nebula (your private vault). An encrypted store on your own device that holds your preferences, logins, and a record of every permission you have granted. AI agents never get the whole Nebula. They get only the few facts a task needs.

  • The Warp Drive (the assembler). The agent in charge. It plans, gathers content, checks it, ranks it, and assembles the page you see. Browser companies still compete here, just as the first post predicted.

The most important connection in the whole design is between the Warp Drive and that model switchboard. Because the switchboard speaks a common language, the same Galaxy, 42, and Nebula work with any model you pick.

Bring Your Own Model

"Bring your own model" means exactly what it sounds like. You decide which AI does the thinking: one from OpenAI, Anthropic, Google, or xAI, or a model running locally on your own computer.

This is realistic today, because many AI companies now offer a shared, OpenAI-compatible way to connect. xAI offers one. So does Google for Gemini, though Google notes its support is still in beta. Ollama, a tool for running models on your own computer, offers one too.

It is not perfectly uniform, and an honest design says so. Anthropic describes its compatibility layer as "not considered a long-term or production-ready solution" for most uses, so ABE should connect to Claude models directly. That is fine. A good switchboard uses the shared connection where it works and a direct one where it does not.

Three choices make this genuinely useful:

  • Pick a model per task. I would want a local model for health and money questions, so that reasoning stays on my device, and a powerful cloud model for open research.

  • Keep tools separate from models. If the way an agent reaches content is the same for every model, switching models does not break anything.

  • Keep the private part private. My first post promised the Nebula "never shares your raw data upstream." Sending everything to a cloud model would break that promise. So the Warp Drive should send only the minimum facts a task needs, or use a local model for anything personal.

This already works today: Brave's Leo assistant lets you bring your own model, including local ones. ABE would make that choice part of the core design.

*What this means for you: you choose the AI you trust, and you can switch later without losing your setup.*

Three Open Standards That Let Any Agent Plug In

A lot of technical standards are being written for AI agents right now. Three matter most for ABE, and each covers one kind of connection.

Model Context Protocol (MCP): how an agent reaches tools and information. MCP is an open standard that gives AI agents one common way to connect to tools, files, and data. It is maturing quickly. The newest version of the MCP specification was released on July 28, 2026, with a simpler design and stronger security for logging in. In ABE, MCP is how the Warp Drive reaches content in the Galaxy and facts in your Nebula.

Agent2Agent (A2A): how one agent hands off to another. A2A is an open standard that lets one AI agent pass a task to another agent. It reached version 1.0 in March 2026, and Google, which created it, donated it to the Linux Foundation. In ABE, A2A is how your agent could hand a task to your bank's agent, your airline's agent, or your university library's agent.

Web Model Context Protocol (WebMCP): how today's websites talk to your browser's agent. WebMCP lets an ordinary website tell the browser's agent which actions it offers, so the agent does not have to guess by clicking around. Chrome is testing it now, with an origin trial (an early public test) starting in Chrome 149, and Microsoft Edge has its own trial in Edge 150. Not everyone is on board yet. In August 2026, when a World Wide Web Consortium (W3C) working group reviewed a plan to take on WebMCP, an Apple representative noted an opposing position from Apple's WebKit team. My read is that WebMCP will reach Chromium-based browsers first. For ABE, it is the bridge for today's websites while the web transitions.

Smaller pieces fill the gaps: license labels a computer can read, digital signatures that show where content came from, and signed proof that you approved a purchase. The pattern matters more than any name. Every connection that would normally need a private deal between a browser company and an AI company becomes a public standard.

*What this means for you: agents from different companies can work together for you, without you being locked into one company's world.*

Agent Safety Starts With Your Permission

An agent that can act for you is only as good as the limits it respects. So ABE puts a permission gate in front of everything the agent wants to do. Each proposed action is checked against what you actually asked for and how risky it is.

I would sort actions into five levels:

  • Reading public information (summarize a page, search open sources): allowed by default.

  • Reading with your accounts (search journals with your university login): you allow it once per source, and you can take it back anytime.

  • Low-risk actions (fill out a form, add to a cart, draft a message): the agent shows you its plan and you approve it once per task.

  • Sensitive actions (buy something, send a message, share health or money details, change an account): you confirm every single time, with a plain-language summary.

  • Never allowed (click past a security warning, export your whole Nebula): blocked, period.

The agent never sees your passwords; it gets short-lived, limited permissions instead. And every action lands in a log on your device, so you can always see what was done in your name.

Prompt Injection: The Attack That Matters Most

Prompt injection is when hidden text on a web page pretends to be an instruction from you, and a careless agent obeys it. It is a close cousin of the impersonation attacks I studied for my doctorate.

This has already happened. In August 2025, Brave's security team showed that Perplexity's Comet browser could be steered by hidden instructions on a web page, and later found instructions hidden inside screenshots. Because ABE's Warp Drive reads content from many sources, this is its number one threat.

The good news is that the defenses are known, and layering them works:

  1. Treat everything the agent reads (web pages, Galaxy content, messages from other agents) as information, never as commands.

  2. Before any action runs, have a separate checker confirm it matches what you actually asked for.

  3. Require your confirmation for sensitive actions, no matter what the agent's plan says.

  4. Keep the agent's browsing separate from your normal signed-in browsing.

  5. Give each task the least access it needs. Summarizing a page should never unlock your email.

  6. Use automatic injection detectors as one layer, not the only one. Perplexity has published its BrowseSafe research on exactly this layered approach.

  7. Prefer content with a publisher's digital signature, so the agent can tell trusted content from scraped text.

*What this means for you: the agent does the busywork, and you stay in charge of anything that matters.*

What Today's AI Browsers Already Teach Us

The market has been running experiments for us, and the results point toward openness.

The Open Path Is the Practical Path

In the first post, I said the important questions were who builds the infrastructure, who governs the index, and who owns the Nebula. Building ABE on open standards answers all three in your favor. The rulebook is public. The index lists but never ranks. The Nebula stays on your device. And the AI model is yours to choose.

I am optimistic, and not because of good intentions. The hard parts are already being built in the open, by many companies at once. ABE's job is to connect them in a way that keeps you in charge.

In my next post, I will take on a problem that gets worse as more of the web is written by AI: citation recursion, and how an open browser could help stop it.

Sources

  1. The Website is Dead. Long Live the Web., anarchistsguidetotheinternet.com

  2. So, you want to maintain a Chromium fork?, Vivaldi (Yngve)

  3. Chat Completions, xAI docs

  4. OpenAI compatibility, Gemini API docs

  5. OpenAI compatibility, Ollama docs

  6. OpenAI SDK compatibility, Claude docs

  7. Bring Your Own Model with Brave Leo, Brave Help Center

  8. The 2026-07-28 MCP Specification, Model Context Protocol blog, Jul 28, 2026

  9. A2A changelog, GitHub

  10. A2A Protocol, a2a-protocol.org

  11. WebMCP, Chrome for Developers, Updated Oct 7, 2026

  12. WebMCP implementation status, GitHub

  13. WebML WG minutes, Aug 13, 2026, W3C

  14. Indirect prompt injection in Perplexity Comet, Brave

  15. Unseeable prompt injections in screenshots, Brave

  16. BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents, Perplexity Research

  17. OpenAI is discontinuing ChatGPT Atlas, 9to5Mac, Jul 9, 2026

  18. ChatGPT Atlas retirement, OpenAI Help Center

  19. Chrome gets Gemini 3 features, including auto browse, Google blog

  20. Opera Neon adds MCP Connector, Opera Newsroom, Mar 31, 2026

  21. Your AI agents can use Opera Neon free of charge, Opera Neon

 
 
 

Comments

bottom of page