TL;DR Agents are already most of the traffic on the web, but the web still hides behind logins, CAPTCHAs, and forms that were never built for them, and a single session forgets everything the moment it ends. In a joint webinar, Browserbase and Box walked through how those two gaps close together: Browserbase gives agents a real browser to reach the 85% of the web with no clean API, and Box gives them a shared, permissioned, version-controlled file system to remember and collaborate on what they find.

Watch the full webinar below.

Chris Kim, a senior developer relations engineer at Box, hosted Kyle Jeong, a growth engineer at Browserbase, for a session on connecting both platforms to your agents. An agent that can act in the real world needs two things it rarely has together. It needs to reach systems that only exist as websites, and it needs somewhere durable to put what it learns so the next run, and the next teammate, can build on it.

Why do agents need a browser at all?

The new user of the internet is not a human. Cloudflare's own numbers, cited by CEO Matthew Prince, put more than 60% of traffic across their network as agents rather than people. The problem is that most of the web was built for humans clicking, not agents calling. A large share of it sits behind CAPTCHA walls, login portals, and pages with no clean API, which is exactly where most knowledge work happens.

Browserbase is the platform for building browser agents: agents that use a real browser to do work on behalf of a person. You get the primitives to give an agent proper web access. Search and Fetch read from the web cheaply. When an agent needs to write to the web, submit a form, click through a flow, or download a file, it needs a browser, so Browserbase runs headless Chromium browsers in the cloud that can act on any site.

Agent identity: trust and authentication

Trust is how an agent gets access to the web safely: Browserbase partners with providers like Cloudflare and uses Web Bot Auth, an open protocol, to cryptographically sign HTTP requests from browsers. A provider can check the signature, see the browser is Verified as coming from Browserbase, and let it through instead of throwing a challenge. Residential proxies and automatic CAPTCHA solving round out access for sites that still push back.

Authentication is the other half: staying logged in. You do not want an agent re-entering a password and a 2FA code on every run. Contexts save the state of a browser after a login so future sessions resume already authenticated, and you can attach one context to any session or spin up thousands of them for different portals. Browserbase is SOC-2 Type II compliant and HIPAA-ready, and for teams that want nothing retained, it offers zero data retention and per-session controls to disable recording and logs.

What is Stagehand, and why not just use Playwright?

If you have done any browser automation you have met Playwright, Puppeteer, or Selenium. They drive a browser through the DOM, and they were written for testing front-end UIs. That heritage makes them a poor fit for handing to an agent: the extra surface area is token-heavy and slow when a model is the one deciding what to do.

Stagehand is built around three AI primitives instead. act takes a natural-language instruction and performs it on the page. observe returns the actions available on a page, like a clickable button. extract pulls structured JSON out of a page against a schema. All three are self-healing: when a page changes and a cached action misses, the primitive looks at the page again and updates what it does, so you are not paying an engineer to babysit brittle selectors.

The recently launched Stagehand v4 moves the runtime into the browser itself as an extension. Putting the runtime inside the browser shortens the round trip for every CDP command, which benchmarks to roughly 2x faster than Playwright on executable actions, and it unlocks batching: when a model knows it needs to click three things, Stagehand can dispatch them at once instead of one round trip at a time. Accessibility-tree pruning keeps the page snapshot small so long-horizon tasks do not blow out the context window.

Around those primitives sits a model gateway and router that benchmarks frontier models on real production tasks and automatically serves the most accurate, most cost-efficient one for the job, so you are not throwing your most expensive model at every step. Domain allow-listing blocks any URL you do not want an agent touching at the browser level, a real defense against prompt injection. Action caching, on automatically, replays consistent actions without new LLM calls and has saved customers up to 30% in token cost. Stagehand also reaches into nested iframes and shadow DOM that Playwright cannot, which matters for legacy portals and EHR systems, and it is OpenTelemetry-compatible so you can pipe traces into tools like Braintrust.

Where does Box fit, and why not just a local file system?

If Browserbase gives an agent hands to act on the web, Box gives it a memory that other people and other agents can share. Chris made the case that a single agent session is always context-limited, so teams started exporting memory to files an agent can re-read later, which produces impressive personal knowledge bases that act as a second brain for one agent.

Real work is collaborative, and that is where a personal file store falls apart. When agent A shares a document with agents B and C, everyone ends up with a copy, the copies drift out of sync, and no one can tell which version is current or which files are even safe for an agent to touch. Chris pointed to the horror stories: agents reaching confidential files they should never have seen, then taking irreversible actions on them.

Box's answer is to move that personal vault into a shared, governed file system that agents, humans, and applications all connect to as a single source of truth. Files stay synced. Every actor, including each agent, gets its own permission boundary, so an agent might see one folder while you see the rest. Every file keeps a full version history you can revert to, and every action an agent takes is reviewable and auditable. Connecting an agent to Box takes a platform app for credentials, a set of scoped folders, and the Box CLI, MCP, or REST API to wire it in.

Where this leaves us

Give an agent a real browser and it reaches the rest of the web the way a person does. Give it a shared, governed file system and what it finds becomes durable, permissioned, and collaborative instead of trapped in a single session.

That is the layer Browserbase runs: real browsers at scale, Verified access to sites that check who is asking, Contexts that keep agents logged in, and a recording of every session for when a run needs explaining. If you want to build the setup from the webinar, you can create your first session in a couple of minutes.