Two browsers with different owners
The BrowserOS repository now contains two related products. BrowserOS neo is a secondary browser intended for Claude Code, Codex, Cursor, and other MCP agents. A person keeps using their normal browser while agents receive separate tabs, imported logins, and a dashboard showing active work. The original BrowserOS is a daily Chromium fork for humans, with an AI side panel and agent built into every new tab.
That distinction matters. Neo is the more convincing design for automation because it separates human browsing from agent activity. Several agents can work in parallel, each in its own tab. The user can watch live and replay a saved session with an action timeline. Original BrowserOS instead blends browsing and assistance, offering summaries, extraction, scheduled tasks, file work, app integrations, and ad blocking in one main browser.
Both run local browser processes and let users choose cloud model APIs or local models. They are AGPL-licensed Chromium forks, not extensions constrained by Chrome's extension surface.
Logged-in state is the defining capability
Headless automation usually starts a clean browser. That is good for tests but awkward for “clear my inbox” or “update the CRM,” where the valuable state is authentication. Neo imports Chrome logins, bookmarks, extensions, and settings, then preserves them across sessions. MCP tools expose browsing actions to external agents, while the cockpit shows what those agents are doing.
This solves a real usability problem and creates the project's biggest risk. An agent with a logged-in email, social, finance, or business account can make durable changes under the user's identity. Prompt injection in a web page can influence an agent that reads it. A mistaken selector can target the wrong record. Approval dialogs may become routine and get accepted without review. Session replay helps explain what happened after the fact; it does not prevent the action.
Use a dedicated profile with the smallest useful account set. Prefer test tenants, read-only roles, spending limits, and provider tokens without unrelated access. Keep automatic posting, deletion, purchases, and credential changes out of early trials.
Local-first has important qualifications
The README says neo stores sessions, screenshots, history, and settings under a local directory and does not upload them. It also says anonymous usage events such as agent connection, version, and operating system are sent, excluding URLs, page content, prompts, tool results, and screenshots, with a settings toggle to disable this. Logged-out conversation history is currently being moved from extension storage into a local SQLite server.
Model traffic still goes wherever the selected model runs. Cloud Claude, OpenAI, Gemini, or another provider receives the prompt and browser context assembled for the task. Ollama or LM Studio can keep model execution local, but capability and tool behavior depend on the chosen model. “Everything runs on your machine” describes the application architecture, not every optional AI request.
Session recordings are sensitive even when local. They can contain inboxes, internal tools, addresses, and account data. Backups, malware scanners, and shared user accounts may copy or expose the directory. Operators should set retention, permissions, and disk-encryption policy rather than treating local storage as automatic privacy.
Neo is moving faster than its compatibility layer
The latest release, tagged browserclaw/v0.49.3 on August 6, 2026, renamed BrowserClaw to BrowserOS neo and described improved tools and reliability fixes. The repository was pushed on August 12. Rapid work is visible across the Rust server, TypeScript dashboard, Go CLI, Chromium fork, and packaging.
Neo supports macOS and Windows but not Linux. Issue 2176 says development has shifted toward neo while legacy users lack one-click migration for providers, MCP configuration, history, bookmarks, extensions, and skills. Linux users cannot move at all yet. New adopters should choose deliberately rather than assume the two products share state.
MCP compatibility is also changing. Issue 2168 reports that the server's version negotiation fails with a client implementing a newer 2026-07-28 protocol revision, though Claude Code connects. Other reports show the CLI's status route returning 404, JSON open omitting the documented page identifier, and an open command sending a field rejected by the server tool schema. Pin server, browser, CLI, and client versions as one tested set.
Browser forks carry systems-level risk
A Chromium product is much larger than an agent extension. The browser must track upstream security fixes, native messaging, extension behavior, profiles, signing, installers, power management, and operating-system process rules. The README estimates about 100 GB of disk for browser development, while the agent platform alone spans Rust, TypeScript, Bun, React, Go, and Chrome DevTools Protocol bindings.
Two current reports deserve attention. On Windows, issue 2072 says launching native messaging hosts through cmd.exe can orphan the real host processes; one long reproduction accumulated 1,196 processes, roughly 20 GB of memory, and hundreds of thousands of handles. On macOS, issue 2073 says a failed capture session retained a display-sleep assertion for almost two days and drained the battery. These are user reports, not universal measurements, but both concern cleanup paths that ordinary feature testing can miss.
Browser tools have site-specific limits too. An upload issue shows a transient file input in Telegram Web disappearing before the MCP tool can reference it. An evaluation timeout is accepted but reportedly not enforced. Autonomous browsing always meets applications designed to resist or outlive static automation assumptions.
The buying decision
BrowserOS has 67 open issues and pull requests, active community voting, frequent releases, and unusually detailed technical reports. Documentation clearly explains the two-product architecture, local data policy, agent connections, and build boundaries. Maturity trails ambition, especially around packaging and cross-version contracts.
Neo is worth a supervised trial for persistent agent browsing because it offers a better human oversight surface than an invisible headless process. Original BrowserOS suits enthusiasts wanting a BYOK AI browser on Linux or a daily integrated assistant. Neither should begin with the user's most valuable accounts. Establish a limited identity, verify MCP compatibility, disable unwanted telemetry, watch resource cleanup, and earn trust one workflow at a time.