Kitesurf vs Playwright: Where the Agent Browser's Trust Boundary Sits
Cloudflare open-sourced Kitesurf, a browser built for AI agents, on 13 November 2026, and Phoronix covered it the same day. This hands-on test plan asks one narrow question: where does the trust boundary actually sit, and can you see it in the process table? What the release confirms: it is a browser aimed at agents, it is open source, and browser infrastructure is being positioned as a first-class layer for agent workloads. What the announcement does not tell you: the license, whether per-session process isolation is the default, whether it is a Chromium fork, and what egress or credential scoping looks like. The author labels every claim as confirmed or inferred. The video walks through a reproducible Playwright baseline, the process tree it leaves at idle, and why a BrowserContext is a cookie boundary rather than a process or sandbox boundary. Process separation follows Chromium's site isolation, so two contexts on the same origin share a renderer, which is not a tenant boundary. From there: why request interception is necessary but advisory, and why the egress policy you can actually trust is enforced below the browser, with the proxy flag and host resolver rules that remove ambient DNS. On top of that, the three boundaries worth measuring separately, process, sandbox, and credential, and why one container per tenant is the honest default until the session API is documented. The post also makes the adapter point: driving both stacks through one open, snapshot, close triple is a config change, and if that adapter cannot be written in an afternoon, the abstraction leaks exactly where lifecycle and isolation live. Full write-up: https://hackyjs.com/posts/kitesurf-hands-on-testing-cloudflares-agent-first-browser-against-a-playwright-stack