Cloudflare Builds Kitesurf, a Browser for AI Agents

Cloudflare has launched Kitesurf, a cloud-hosted web browser with no user interface, no window, and no human on the other end. It is built for AI agents — software that needs to open pages, read them, fill in forms and click through flows — and it runs entirely inside V8 isolates on Cloudflare Workers. It is free during beta through the company’s Browser Run service, subject to per-account limits.

The argument for building it is economic. Chromium was designed for people, and running one Chromium instance per agent is expensive enough to cap how many agents a company can afford to run at once. Cloudflare’s benchmarks, taken as medians across a 14-URL corpus, put Kitesurf at 380 ms of CPU per screenshot against Chromium’s 1,173 ms, and 229 ms against 877 ms for HTML extraction — roughly 3.1× and 3.8× less CPU. Memory is the bigger gap: 57.8 MiB versus 271.0 MiB on screenshots, and 39.4 MiB versus 273.7 MiB on extraction, a 4.7× to 7.0× reduction. The trade-off is latency — Kitesurf is about 1.8× slower in wall time on screenshots and 1.7× slower on extraction, with most of that cost in rasterisation and image encoding.

The engineering is a study in assembly rather than invention. The team built it in roughly 12 weeks by stitching together existing Rust components compiled to WebAssembly: Blitz for the modular rendering engine, Firefox’s Stylo for CSS parsing, Parley for text layout, and Boa as the JavaScript engine — the last because Workers does not expose a native eval. The browser splits into isolated Workers components: an Engine that is the only public surface and speaks Chrome DevTools Protocol over WebSocket plus HTTP REST; PageScript, which gives every page and iframe its own long-lived isolate with a clean globalThis and DOM; PageRenderer, which rasterises to JPEG, PNG or PDF; and SandboxOutbound, the sole component that touches the network, where CORS, browser headers, per-page cookies and policy blocks are enforced.

Because the protocol surface is CDP, existing tooling works without a rewrite — Puppeteer, Playwright, chrome-remote-interface and MCP clients connect unchanged by adding a browser=kitesurf parameter. Cloudflare says Kitesurf already passes more than 215,000 Web Platform Tests, with hundreds more clearing each week, and renders Wikipedia, Hacker News and the TodoMVC suite correctly. There is a public playground with Chrome DevTools injected, exposing DOM, console, network and per-isolate WebAssembly memory.

The gaps are stated plainly, which is unusual enough to be worth noting. Kitesurf does not yet handle video playback, WebGL, TLS-fingerprint bot challenges, or long authenticated stateful sessions, and Cloudflare recommends falling back to Chromium for complex pages, positioning Kitesurf as production-adjacent for compatible sites and one-shot tasks. That list is also a map of where agent traffic tends to break: the bot-challenge item in particular sits awkwardly beside Cloudflare’s own role in deciding which crawlers get through.

Security is the other design axis. Dropping human-facing features shrinks the attack surface, and the per-page isolate model is aimed squarely at containing prompt injection — if a hostile page can only ever talk to its own isolate, a successful injection buys the attacker much less. Cloudflare says it plans to open-source Kitesurf so customers can run their own instances, which is the part that would make the benchmark claims independently checkable. Until then, the interesting question is whether a browser this stripped-down can hold compatibility as the web keeps being built for eyes.