Your browser, but the AI actually lives inside it

What it does

Tandem Browser is an Electron-based Chromium browser that embeds AI agents directly into the browsing session rather than parking them in a sidebar. The agent sees the same logged-in pages, cookies, and tabs you do, operates via the accessibility tree and live network log, and can rewrite page UI on the fly. It connects through MCP or a 257-endpoint HTTP API, supports multiple simultaneous agents, and runs entirely local-first — no backend service.

The interesting bit

The security model is the quietly paranoid part that makes the whole thing feasible: an 8-layer perimeter sits between web content and the agent layer, treating any hidden page instruction as potential remote code execution. The README is explicit that this matters because “when an AI has access to a real browser, a hidden instruction in a page is remote code execution without an exploit.” Meanwhile, the agent gets semantic structure (accessibility tree, DOM, network) rather than screenshot loops, which the project argues are “slow, fragile, and expensive.”

Key highlights

• Model-agnostic by design: MCP or HTTP, local or remote over Tailscale — Claude, GPT, Ollama, custom scripts, swap at will
• Real authenticated automation: works with Gmail, bank portals, internal tools — anything you can browse while logged in, no API required
• Human-in-the-loop handoffs: tab locks, explicit approvals, CAPTCHA delegation — the agent doesn’t pretend to be you
• 257 tools across 16 categories: navigation, DevTools, network inspection, session isolation, bookmarks, form vault, device emulation, live HTML previews
• Stealth over headlessness: websites see normal Chrome, not automation tooling; background tabs operate without focus theft

Caveats

• macOS Apple Silicon builds are signed and notarized; Windows builds are official but currently unsigned, triggering SmartScreen warnings
• Linux is “best-effort” — not a fully supported platform
• New agents must complete a bootstrap sequence (/skill, /agent/manifest, /agent/bootstrap) or Tandem returns 428 agent_startup_required; skipping it breaks connectivity

Verdict

Worth a look if you’re tired of screenshot-loop agents that can’t handle logged-in SaaS, or if you want genuine co-browsing where the AI and human share context rather than chat logs. Skip it if you need cross-platform parity (Linux support is thin) or if your use case is simple API-driven automation where Playwright suffices.