AI Agents Are Missing Their Browser Moment

The browser model is imperfect. Fights over DRM and tracking continue. But it embeds checks and balances that operate transparently through public standards processes.

The Trust Gap in AI

Current AI agents operate without this layer. Unless you build your own agent, you are using software that embeds its creator's interests with limited accountability. The agent may claim to work for you, but you have little assurance it actually does.

This lack of trustworthiness cuts both ways. Data sources and services that agents consume cannot verify how their information will be used. Unlike a browser, which constrains how sites access data, an unconstrained agent could resell, store, or republish information unpredictably.

AI agents are being deployed with the capabilities of browsers but without the institutional architecture that made browsers trustworthy.

Some proposals suggest trusted execution environments (TEEs) as a solution. Nottingham dismisses this as incomplete. Technical isolation does not solve the collective action problem: if agents can request intrusive permissions, users will face a constant barrage of requests, leading to click-through acceptance and eroded trust.

The Platform Capture Risk

The alternative to user agency is platform capture. Nottingham sketches the scenario: Meta wants smart glasses that feed social media engagement. Amazon wants Echo speakers that drive marketplace purchases. OpenAI wants chatbots that mediate all digital interaction.

Each platform serves its own interests first. Without a standards-based user agent role, users have no collective leverage to demand better terms.

Nottingham contrasts the browser ecosystem with mobile platforms. iOS and Android make decisions opaquely within single corporations. The checks on their power differ fundamentally from the public accountability of web standards processes.

"Will it be like the major mobile platforms, controlled by private and well-intentioned but self-interested and conflicted actors?" Nottingham asks. "Or will it be a publicly accountable process, like the Web?"

Early Steps

The essay acknowledges nascent efforts toward AI user agency. Projects like A2UI (Agent-to-User Interface) represent small steps in this direction. But Nottingham argues that constraining AI agents will require standard tool APIs, permission models, and sandboxing that becomes "normal," so users can depend on consistent behavior.

He notes that Apple appears to be taking time with Siri enhancements precisely because building an ecosystem that respects user rights while creating market opportunities is harder than shipping unconstrained capabilities.

The core tension: the AI industry wants to explore what agents can do before constraining them. Nottingham warns that wide-open exploration eventually hurts more than it helps. Users are already confused by technology that offers too many choices. Without constraints, agents will proliferate in ways that fragment collective agency and leave individuals to fend for themselves against platforms with far more bargaining power.

The Stakes

Nottingham frames user agency as functional infrastructure, not a security add-on. "Security is a defensive posture; agency is a functional right," he writes.

The distinction matters for regulation. Current "AI safety" discussions focus on preventing harms. Nottingham suggests that an architecture assuring user agency could create competition, forestall heavier regulation, and make the technology more legible to users and legal systems alike.

For builders, the essay raises a design question that often gets buried under capability announcements. The agent race is not just about which system can use the most tools or handle the longest contexts. It is about who decides what "on behalf of the user" actually means, and whether that decision happens in public standards bodies or private platform meetings.

Nottingham's argument is that the answer will determine whether AI agents become infrastructure worth building on, or another round of platform extraction wearing agentic clothing.

Apr 21, 2026