Kitesurf: Cloudflare's Agent-First Browser Runs in V8 Isolates on Workers

Cloudflare's Agents Week closed its run with its most ambitious claim yet: a browser built from scratch for AI agents, with no Chromium at all. Kitesurf is a stateless, agent-first browser that runs entirely on Cloudflare Workers, announced August 6 and available free in beta through the Browser Run API. It is 12 weeks old, passes more than 215,000 Web Platform Tests, and does not execute a single line of browser-engine C++.

What shipped#

Kitesurf is a rendering engine that speaks the same protocol agents already use. It implements the Chrome DevTools Protocol (CDP) WebSocket and REST interfaces, so existing clients work unchanged: Puppeteer, Playwright, chrome-remote-interface, and the Chrome DevTools frontend. You opt in with one parameter on Browser Run endpoints: browser=kitesurf. An MCP client setup is documented using chrome-devtools-mcp pointed at Kitesurf's WebSocket endpoint, so agent harnesses that speak MCP and CDP can drive it today.

Inside, the browser is a set of Workers components:

• The Engine is the only public-facing piece. It serves CDP, stores session state, and coordinates the others.
• PageScript runs the page. Every page or out-of-process iframe spins up a long-lived isolate via Dynamic Workers, with a clean globalThis and a DOM populated by parsing HTML and executing JavaScript. Parsing uses parts of Blitz (a modular rendering engine from DioxusLabs) and Stylo, Firefox's CSS parser, both Rust.
• PageRenderer turns the computed page object into pixels, rasterizing frames with the blitz-paint module and Parley for text shaping.
• SandboxOutbound is the only component allowed to touch the network. It enforces CORS, injects browser-shaped headers, filters responses, and gives each page its own cookie jar. Everything else gets a 403.

Because Workers does not support eval, page scripts that use it run through Boa, a Rust ECMAScript engine, as a stopgap until native eval support lands. Every failure degrades to a blank frame or missing element rather than a dead session, and every component except the Engine is stateless: kill it, relaunch it, replay the request.

The numbers that matter#

Cloudflare benchmarked Kitesurf against a warm-pool Chromium across a 14-URL corpus, medians of five Browser Run quick-action runs:

• CPU for a screenshot: 380 ms vs 1,173 ms, 3.1x less
• CPU for HTML extraction: 229 ms vs 877 ms, 3.8x less
• Memory for a screenshot: 57.8 MiB vs 271.0 MiB, 4.7x less
• Memory for HTML extraction: 39.4 MiB vs 273.7 MiB, 7.0x less
• Wall time is the one loss: 1,148 ms vs 637 ms for screenshots, about 1.8x slower, because a JIT that has already seen the page beats a cold software renderer

The trade is deliberate: memory and CPU drive the bill in agent workloads, so Cloudflare took a hit on wall time to cut the dominant cost by 3-7x. Fewer resources per session means more concurrent agent browsers per account and cheaper screenshots, HTML extraction, and PDF generation at scale.

Compatibility is early but real. TodoMVC (vanilla, React, Vue, Angular, Preact), Wikipedia, Hacker News, and the Cloudflare blog render correctly. What it cannot do yet: video, WebGL, bot-challenge handshakes that need real TLS fingerprints, and long authenticated sessions that require persistent state. Those go to the default Chromium path in Browser Run.

Why this matters for developers#

The argument behind Kitesurf is that Chromium is over-specified for agents. Agents do not need tabs, themes, extensions, or 60fps scrolling. They need low token cost, cheap context, fast startup, and isolation against pages that are untrusted input. A browser purpose-built for that trade-off changes the economics of anything that renders the web at scale: screenshot pipelines, PDF generation, content extraction, and computer-use loops.

This is the same bet Cloudflare has been making all week, from the container-as-tool argument in its agent runtime to stateless everything. Kitesurf is the strongest version of it because a browser is the hardest component to replace, and the architecture leans on primitives that did not exist until recently: Dynamic Workers, Worker-to-Worker RPC, SQLite-backed Durable Objects, and mature Wasm support. The project started as a port of obscura, an open-source Rust headless engine with no Chrome, no Node.js, and no dependencies, and an AI agent did much of the porting, with Web Platform Tests as the goalposts that kept it honest.

For developers, the practical takeaway is that agent web interaction now has a third shape next to full Chromium and the DOM-only approaches: a cheap, CDP-compatible, serverless renderer that speaks the protocol your Puppeteer or Playwright code already uses. If your agent workload is one-shot screenshots or structured reads of compatible sites, browser=kitesurf is worth a benchmark run today, because the per-session resource curve is the part of your bill you can actually move.

Cloudflare says Kitesurf will be open sourced once ready, so teams could eventually run their own instance on their own account. Until then, the playground at kitesurf.cloudflare.app lets you point it at any URL and watch DOM, console, and memory per isolate.

Continue Reading#

• @cloudflare/computer: an Agent Runtime That Treats a Container as a Tool, Not a Home
• StateAct: Program State as the Interface for Computer-Use Agents
• WebMCP: Google's Browser Standard That Lets AI Agents Use Websites as Tools
• Agent Sandbox Architecture: Isolating Untrusted AI Workloads
• Claude Computer Use: How the Model Operates a Desktop

Sources#

• Introducing Kitesurf: The agent-first browser that runs in V8 isolates on Cloudflare Workers (Cloudflare Blog, August 6 2026)
• Kitesurf Playground
• Browser Run documentation
• obscura: headless engine in Rust for AI automation
• Web Platform Tests