मुख्य कंटेंट तक स्किप करें

Shared-Login Browsers for AI Agents: The ego lite Pattern

मध्यम

For most of 2025 the practical answer to "how does my coding agent drive the web?" was Playwright or Puppeteer wrapped in a tool. That works for scripted flows but breaks on the interesting cases — anything behind a login, anything that needs a real Chrome profile, anything you'd rather not re-authenticate on every run. A newer pattern has emerged in mid-2026: a shared-login browser that runs alongside your own tabs, hands each agent its own isolated workspace, and gives you back structured page snapshots instead of raw HTML. On July 24, 2026 the reference implementation — citrolabs/ego-lite — hit #1 on GitHub Trending, and every major agent CLI (Claude Code, Codex, Cursor, Kiro) got support the same week.

This page is the practical read on that pattern: what it fixes that headless-browser tools don't, how it plugs into Claude Code specifically, and the security trade-off you're signing up for the moment you let an agent share your Google session.

What you'll learn
  • Understand what a 'shared-login browser for agents' is and why it beats headless Playwright for the interesting cases
  • See how Spaces isolate agent tabs from your own without launching separate profiles
  • Learn what a semantic snapshot returns (and why it uses fewer tokens than a DOM dump)
  • Install ego lite and its skill into Claude Code with two commands
  • Weigh the real security cost of handing an agent your logged-in cookies — and know what NOT to do

The problem this pattern solves​

Every agent that has ever tried to browse the web has hit the same three walls:

  1. Login walls. Anything behind SSO — GitHub, your email, your project tracker, your bank — is invisible to a fresh Playwright profile. Storing credentials in an agent config to work around this is a security fire.
  2. DOM dumps blow the token budget. A Google Docs page or a modern React app snapshots into tens of thousands of tokens of noise. Most of it is layout scaffolding the model doesn't need.
  3. Your Chrome and the agent's Chrome are fighting for the same window. Kick off a long browsing task and either you can't use your browser for 20 minutes, or the agent's tabs interfere with your work.

ego lite's approach — and the reason the same pattern is now spreading — is to treat these as one problem. Run a single custom Chromium build. Give the user their own tabs. Give every agent its own Space — an isolated workspace with its own tab stack but sharing the profile. Emit semantic snapshots instead of raw DOM. Everything stays local; no separate profile management, no shipped-off HTML.

Spaces: how the isolation actually works​

From the ego lite documentation: "Spaces are workspaces both you and your agent can use. Group your tabs by project in yours; your agent runs tasks on its own." The important detail is what a Space is not — it is not a separate browser profile and not a separate cookie jar. It is a partitioned tab surface sharing the same underlying session. That's what makes shared-login work: when the agent's Space navigates to github.com, it inherits the same auth cookies your logged-in tabs use, without the agent needing to see or store your credentials.

The isolation is at the UX and tab-management layer, not the security boundary. This is the load-bearing distinction most reviewers miss. It's why the pattern is practical (agents just work on your logged-in sites) and it's also why the security section below matters (an agent operating in a Space has the same effective privileges as you).

Watch out

The Space model shares session cookies by design. That is the whole point — and the whole risk. Anything a compromised or prompt-injected agent can do in its Space, it can do as you, on any site you're logged into. Treat "give my agent a Space" as equivalent to "let my agent act as me on the web" — because it is.

Semantic snapshots vs. raw HTML​

The other shift is what the agent reads when it "looks at" a page. Playwright hands you a DOM. ego lite hands the model a semantic snapshot — a structured summary of the page's interactive elements with stable references you can act on, produced from inside a custom Chromium engine rather than a JavaScript shim on stock Chrome. The vendor claim is that "complex browser tasks finish up to 3.45x faster than agent-browser, on fewer tokens" (lite.ego.app). The exact multiplier depends on the task; the direction — fewer tokens, more reliable ref actions across iframes and shadow DOM — is the durable insight, and it's the same reason Chrome DevTools' Accessibility Tree and the emerging W3C AI-oriented DOM proposals lean the same way.

★ Why this matters beyond ego lite: the "give the model a semantic view, not a DOM dump" idea is going to spread. When you evaluate any browser-for-agents tool in the next 12 months, ask what shape the snapshot has. If it's an HTML dump, you're paying for it in every turn's token count. If it's a structured, refable snapshot, the agent can plan on it cheaply.

Installing ego lite for Claude Code​

Two artifacts, two commands. First the browser app (a Chromium build for macOS — Windows and Linux are on the roadmap but not shipping as of late July 2026), then the skill that teaches your agents to talk to it.

Guided walkthrough1 of 5
  1. Download the .dmg from the project site (Apple Silicon or Intel), or install via the project's documented flow. First launch offers optional migration of Chrome logins, cookies, extensions, and bookmarks into the ego lite profile.

Claude Code — start small: agent runs a single authenticated task in its own Space

/ego-browser
Open my GitHub notifications tab. For each notification from the last 24 hours,
report: repo, kind (issue/PR/mention), title, and a one-line summary of the
newest comment. Do not click through, do not mark anything as read, do not
navigate away from the notifications page.

Notice what the prompt does: it defines the surface (notifications page), the read-only scope (report; don't click; don't mark), and the artifact (a structured list). Every prompt you give a shared-login agent should have those three elements, because you are running it as yourself.

What's actually in the ego-browser skill​

The skill exposes a small set of JavaScript-callable tools the agent writes snippets against — navigate, snapshot, click, fill, wait, capture. The code-based approach is deliberate: instead of a chatty tool-calling loop where the agent asks "please click element ref-12," the agent writes a JavaScript block that composes several actions and receives one structured result back. That's where the "fewer turns, fewer tokens" claim comes from in practice — the round-trip count drops.

You don't need to write those snippets yourself. The skill and the model do. What you should know is:

  • Every action is referenced against the last snapshot. If the page changed underneath the agent, the ref is stale and the tool errors — an important self-correcting property.
  • The skill includes an install.md in skills/ego-browser/references/ — a good place to read if your agent complains it can't find the browser.
  • The MIT-licensed source lives under citrolabs/ego-lite at roughly 4.3k stars as of late July 2026, and the same repo hosts the ego-browser skill sources.

The security cost you are signing up for​

This is where most of the enthusiastic tweets stop and where the interesting engineering starts.

Handing an agent a Space that inherits your logged-in sessions is functionally equivalent to giving it your session cookies. Everything the same-origin policy would allow you to do in a browser — post on your behalf, exfiltrate documents from Google Drive, transfer money from a banking session, invite an outside collaborator to a private repo — is inside the agent's ability. That's not a bug in ego lite; it's the value proposition. The security posture is the price of the ergonomics.

Three concrete practices reduce the blast radius without giving up the win:

  • Different Spaces for different trust tiers. Personal Google + email in one Space. Work SaaS in another. Anything experimental or untrusted (arbitrary URLs from the internet) in a third that has been logged out of everything that matters.
  • Never point a shared-login agent at an untrusted URL you didn't fetch. The whole class of indirect prompt-injection attacks lands hardest here — a page can carry hidden instructions that steer the agent into a data-exfiltration action against your other logged-in sites. Related: Agentic browsers and same-origin risk.
  • Read-only prompts by default. Ask for summaries and lists first. Introduce actions (clicks, form fills) only after you have seen the snapshot the agent is reasoning over. This is the same discipline that makes autonomous runs safe.

Where this pattern is going​

Grok, Cursor, and Kiro have all added shared-browser integrations in the same month, and the underlying mechanism — a custom Chromium plus a skill layer that emits semantic snapshots — is likely to be standardized rather than owned by any one project. The interesting near-term question is not whether every coding agent gets a shared-browser mode; it's whether the snapshot format converges (so an agent skill written for one browser works on another) or fragments the way early MCP servers did.

The concept to hold onto: the browser is becoming a shared surface between humans and agents, not two separate browsers pointed at the same pages. That reshapes what "computer use" costs and what it can safely be pointed at. See also Computer-use agents for how Claude's own browser-control feature compares to this pattern.

Check yourself

0/4
  1. What is a Space in ego lite?
  2. Why does a semantic snapshot beat a raw DOM dump for agent work?
  3. What is the primary security risk of a shared-login browser agent?
  4. You want to try ego lite for the first time with Claude Code. What's the safest first prompt?
Key takeaways
  • Shared-login browsers give agents their own Space in your real browser session — solving login walls, DOM-dump token cost, and window contention in one design.
  • ego lite ships this pattern for macOS today; the ego-browser skill (npx skills add citrolabs/ego-lite) makes it available to Claude Code, Codex, Cursor, and Kiro.
  • Semantic snapshots cut per-turn tokens and give stable action refs; the exact multiplier varies, the direction is the durable insight.
  • The security cost is real: an agent in a shared Space has your privileges on every site you're logged into. Use separate Spaces by trust tier, keep untrusted URLs out, prefer read-only prompts first.
  • This is a pattern, not a product. Expect convergence on 'browser as shared surface between humans and agents' across the ecosystem in the next 6–12 months.

Sources & further reading​