Last week, OpenAI released their new agent, Operator, that can operate its own browser, joining Claude’s Computer Use and many other startups and open-source projects that launched their own browser-agent.
Operator can accept instructions in text, reason about it and create a plan to execute it using the browser. An instruction can be finding and booking an hotel in Airbnb, fill out forms, ordering groceries from Instacart and more.
Operator uses vision capabilities to "see" the browser GUI, capture images, analyze them, and "interact" using a virtual mouse and keyboard. This enables Operator to work with any website without requiring APIs (though it still struggles with complex GUIs, like calendars).
It’s worth reflecting on why we need do we automate browsers using agents (and not just use general internet agents). Browser agents are necessary because most of the internet was built for humans. Humans use GUIs, and for agents to interact with web apps designed for human users, we need to teach AI to use the internet like we do. Most of the user-facing internet doesn’t have an API layer for machine interactions.
If you feel this isn’t as efficient as using computer-native routes like APIs, you’re absolutely right. Humans are slow. Browsers designed for humans are slow too. Machines, on the other hand, operate at the speed of information—essentially the speed of light plus some infrastructure latency. Plus the fact that GUIs meant for people are cluttered with ads, images, and visual elements meant for our eyes, which slows agents down.
It’s important to note that browsers and web apps weren’t just built for humans from a technical perspective, but also from a commercial and legal perspective. The terms and conditions for using e-commerce platforms and payment systems across the internet were designed for humans. Often, it’s unclear what rules apply to machines, making it even more challenging for agents to navigate these systems effectively.
If you really want to understand where Operator’s weaknesses lie (beyond the speed limitations inherent to browser-based interactions, as mentioned above), pay close attention to the Operator demo. After filling a cart from Instacart, they skip the payment step. This is not a coincidence. In many cases, such as solving captchas or processing payments, allowing a browser-agent to handle payments autonomously can present certain challenges.
Let’s go through some of these challenges:
1. Compliance with Platform & Payment Processors Terms
Commercial platforms and payment systems have varying policies around automated interactions:
Payment processors like Stripe require compliance with card network rules for automated/recurring transactions, proper authentication, and fraud prevention measures.
E-commerce platforms often have specific terms around automated interactions, particularly regarding order placement and data collection.
Anti-bot measures like CAPTCHAs are indeed designed to verify human presence, and circumventing them may violate platform terms.
If a browser agent acts autonomously, it needs to ensure compliance with:
Platform-specific terms of service;
Card network requirements for automated transactions;
Payment processor requirements for fraud prevention, and
Proper authentication and authorization protocols.
2. Legal and Liability Risks
Automated payments causes new types of legal and liabilities risks:
Fraud detection: Automated payments or form-filling could trigger anti-fraud systems, flagging the activity as suspicious. Platforms might freeze accounts or reverse transactions.
Liability: If an agent makes an erroneous payment or order, determining responsibility (user vs. agent developer) becomes murky. Most T&Cs place liability squarely on the human account holder.
Regulatory compliance: Financial transactions often require human authorization to comply with regulations (e.g., PCI-DSS for payment security). Fully autonomous agents might bypass these safeguards.
Because large-scale consumer automation (like browser agents) is new, the standards and rules for automated payments never fully evolved. This leaves a lot of gray areas that still need to be figured out.
What Is Needed For Autonomous Payments?
There are a few components that raises important questions about the stack needed to enable browser-agent payments effectively:
Authentication and Authorization: Agents must securely authenticate and authorize transactions in line with platform and regulatory requirements. This could involve integrating advanced fraud detection and multi-factor authentication (MFA) mechanisms.
Compliance Layer - A compliance layer is crucial for navigating platform terms, card network rules, and global regulations. This might include a legal rules engine that helps agents dynamically adapt their behavior to align with platform-specific policies.
Payment Integration - Seamless payment integration requires support for compliance with PCI-DSS standards. This ensures payments are handled securely while mitigating liability risks.
Human-in-the-Loop Mechanism - For critical steps like high-value payments or actions with significant consequences, introducing a human review layer can strike a balance between autonomy and control.
AI Governance and Transparency - Ensuring transparency in agent behavior—such as logging actions and decision-making processes—can help users monitor and audit transactions, reducing liability risks.
Captcha Handling and Accessibility - Developing robust solutions for CAPTCHA handling while staying within platform terms is essential. This could involve partnering with accessibility providers to integrate compliant solutions.
Final Thoughts
While browser agents like Operator open up exciting possibilities, they expose the need for a robust ecosystem to handle payments autonomously. The intersection of technical challenges, compliance requirements, and commercial considerations defines the roadmap for making browser-agent payments both practical and scalable. The companies that solve this puzzle will unlock the full potential of autonomous agents navigating the human internet.
At OpenCommerce, we’re building the infrastructure for autonomous payments. If you have insights or want to collaborate, email us at: