What is an agentic browser? A working definition
Every browser now has a chat panel. The interesting question is what happens after you finish typing.
If the answer is “you read a paragraph”, you have a chat browser. If the answer is “the browser does the next thing for you”, you have an agentic browser. The line is real, and it gets blurred by marketing on purpose. This post draws it the way we draw it inside Maho.
The shift from chat to action
Section titled “The shift from chat to action”The first wave of AI in browsers was chat. Open a sidebar, ask a question, get text. The browser stayed neutral. Pages were inputs, words were outputs. Nothing in your tabs changed unless you copy-pasted.
The second wave is action. The browser is allowed to do things. It can open a tab, fill a field, fetch a URL, summarize the result, file an issue somewhere else. The set of “things” varies. The principle is the same. The browser has a shortlist of moves and can pick one.
Calling this “agentic” is loose, but it is the word the field has settled on. It points at one capability: a model can call a tool, the tool can change something, and the change is visible in the browser. Take that capability away and you have a chat browser. Add it back and you have an agentic browser.
The four signals that make a browser agentic
Section titled “The four signals that make a browser agentic”Marketing pages call most things agentic. Four signals separate a real agentic browser from a chat panel with a strong PR team.
Tool use. The browser exposes a list of tools the model can call. A tool has a name, a typed input, a typed output, and a permission scope. If the assistant can only generate text, no tool use exists, no agency exists. Chat plus a copy button is not tool use.
Page context. The browser reads the page the user is on, not just the chat thread. The agent’s view of the world includes the DOM, the title, sometimes the rendered viewport, sometimes a structured outline. A browser that ignores the page is a chat client that happens to live next to a tab.
Tab awareness. The agent can see other tabs the user has open, with permission. This sounds small. It is the difference between an assistant that needs to be told and an assistant that can cross-reference.
Permission model. The browser has a real grant system. Per tool. Per origin. Per session. The user can deny, allow once, allow always. If permissions are absent or hidden, the browser is not safe to call agentic. It is just a chat panel that occasionally writes to the page.
A browser that hits all four can be called agentic. A browser that hits two should be called what it is, which is a chat panel with extras.
Where the line is drawn (and contested)
Section titled “Where the line is drawn (and contested)”The line is contested in three places.
The first is automation depth. Some browsers do a tool call and stop. Others run a loop: tool, result, tool, result. Both are agentic by the definition above. The depth is a separate axis. We prefer shallow loops with explicit confirmations. Loops without a stop condition are a known failure mode.
The second is invocation surface. Some browsers put agency behind the address bar. Others put it in a side panel. Others let it run unattended in the background on a timer. The first two are agentic browsing. The third is closer to a desktop agent that happens to share a Chromium engine.
The third is trust posture. An agentic browser that ships with a vendor cloud and no opt-out is technically agentic, but the user is renting agency, not owning it. Where the prompts go, where the tool calls happen, what is logged, what gets retained. These choices change what “agentic” means in practice.
We do not pretend to settle the contested edges. We do flag them when we use the word.
Why this term will be misused
Section titled “Why this term will be misused”The word is going to be applied to anything with a chat box for the next twelve months. That is fine. Definitions take time to harden in public.
When you are evaluating a browser, ignore the word and ask the four questions:
- Can the model call a tool?
- Does it see the page?
- Does it see other tabs?
- Are there clear, per-call permissions?
Three out of four is a reasonable bar. Four out of four with sane defaults is rare. Two out of four is chat with a sticker on it.
What to look for when you evaluate one
Section titled “What to look for when you evaluate one”A practical checklist when you try a new agentic browser.
- Open the side panel and ask “What tools can you call?” A serious agentic browser answers with a list. A chat browser answers with a paragraph that does not include tool names.
- Ask the assistant about something on the current page that is not in the URL, like a phrase three paragraphs down. If the answer is wrong or generic, page context is shallow.
- Open a second tab, switch back to the first, and ask the assistant about the second tab. If it has no idea, tab awareness is missing.
- Trigger any action that touches the network. A real permission prompt should appear. If the action runs silently, the permission model is not user-facing.
- Check the BYOK story. Can you point the browser at your own model endpoint? Or are you locked into the vendor’s cloud? Both are valid product choices, but only one of them gives the user real agency over their agent.
The Maho approach to all five is documented in the agentic browser comparison post and in the browser AI docs. The short version is: nine built-in tools, page context plus tab awareness with a clear scope switch, per-tool per-origin per-session grants, BYOK by default.
Where the term goes from here
Section titled “Where the term goes from here”“Agentic browser” will probably collapse into just “browser” within two years, the way “smartphone” collapsed into “phone”. The capability stops being a category once everyone has it.
Until then, the term is useful as a filter. If a browser meets the four signals, it is in the conversation. If it does not, it is a chat panel and should be sold as one.
Get notified
Section titled “Get notified”Maho is a pre-release agentic browser for macOS. It hits the four signals above, with BYOK and zero telemetry by default. Get early access.