---
title: "The Harness Is the New Browser"
slug: harness-is-the-new-browser
summary: "Browsers were called \"user agents\" for thirty years while their defaults, deals, and telemetry served someone else. AI harnesses are repeating the pattern almost feature by feature. Here are the tests I use to spot where I'm the product — and the wells the browser era already fell into once."
tags: ai, agents, browsers, privacy, tooling, opinion
ai_model: claude-fable-5
published_at: 2026-08-28T06:29:12.33+00:00
canonical_url: https://jarkkolietolahti.com/articles/harness-is-the-new-browser
markdown_url: https://cemecdwfdvdbvpvowuln.supabase.co/functions/v1/content-md?slug=harness-is-the-new-browser
---

The technical term for a browser is *user agent*. It's right there in every HTTP request: `User-Agent: Mozilla/5.0`. The name is a promise — this software acts on your behalf. For thirty years, that promise was tested by defaults, bundling deals, telemetry, and business models, and it lost more often than it won.

Now I run an AI coding harness all day. Some company built it, I use it. It's called *my* agent. And the more I compared its ecosystem to browser history, the more the parallels stopped being cute and started being a checklist. This article is that checklist: the controversies the browser era already ran through, mapped to what harnesses are doing today, plus the tests I've started applying to figure out where I'm the customer and where I'm the product.

## The browser was never neutral

A quick tour of the scar tissue, because each scar becomes a test later.

[**ActiveX**](https://en.wikipedia.org/wiki/ActiveX) let web pages run native code with the user's full permissions. It was a security disaster, and because Korean online banking standardized on it, an entire country was locked to Internet Explorer for roughly two decades.

[**Smart Tags**](https://en.wikipedia.org/wiki/Smart_tag_(Microsoft)) shipped in an IE6 beta in 2001: Microsoft's browser auto-inserted Microsoft's own links into other people's web pages. The backlash was loud enough that it died before release. The same thing happened in 2023 with [**Web Environment Integrity**](https://en.wikipedia.org/wiki/Web_Environment_Integrity), Google's proposal to let servers verify you were running an "approved" browser — withdrawn after public outcry.

**The browser wars** gave us `<blink>` and `<marquee>` — each vendor inventing proprietary HTML to lock developers in. **IE bundled with Windows** turned distribution into destiny and triggered an antitrust case. And when IE won, Microsoft largely disbanded the team: the IE6 era meant years of stagnation until Firefox forced competition back into existence.

The modern era is subtler. **Third-party cookies** funded the ad economy; Safari started blocking them in 2017, while Chrome announced a phase-out in 2020, delayed it to 2022, then 2023, then 2024 — then in [July 2024](https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies) swapped the phase-out for a proposed user-choice prompt, and in [April 2025](https://privacysandbox.google.com/blog/privacy-sandbox-next-steps) dropped that prompt too, keeping cookies on with only the existing settings toggle. Not because the engineering differed, but because Chrome's owner sells ads. [**Manifest V3**](https://www.eff.org/deeplinks/2021/12/chrome-users-beware-manifest-v3-deceitful-and-threatening) limited what ad blockers are allowed to do, a browser vendor deciding what your own extensions may protect you from. **Default search deals** are the quiet foundation of the whole market: Google paid Apple [$20 billion in 2022 alone](https://qz.com/google-apple-safari-default-search-engine-antitrust-1851451338) to be Safari's pre-selected search engine — a figure both companies fought to keep sealed until the DOJ antitrust trial surfaced it — and most of Mozilla's revenue still comes from search royalties dominated by its Google deal ([$498M of $680M total in 2024](https://stateof.mozilla.org/pdf/Mozilla%20Fdn%202024%20-%20AuditedFinancials.pdf)) — the same company Firefox supposedly competes with. Even the rebels defected: Brave, the privacy browser, was [caught in 2020](https://www.coindesk.com/business/2020/06/08/brave-browsers-affiliate-link-controversy-explained) rewriting typed cryptocurrency URLs into its own affiliate links.

None of these were bugs. They were features — for someone.

## The same features, rebuilt in a new shell

Once I started mapping, almost every browser controversy had a harness twin:

| Browser controversy | Harness equivalent | Shared mechanism |
|---|---|---|
| ActiveX, NPAPI plugins | Locally installed MCP servers and third-party tools | Arbitrary external code running with your credentials; security bolted on later |
| Proprietary tags (`<blink>` vs `<marquee>`) | CLAUDE.md vs .cursorrules vs the rest, with AGENTS.md as the emerging shared format | Lock-in via incompatible formats for the same job |
| IE bundled with Windows | AI assistants bundled into the IDE, the OS, the office suite | Distribution beats quality |
| Smart Tags | Vendor-injected system prompts and steering you never see | The vendor edits the conversation between you and the content |
| Default search deals | The harness chooses which model answers by default | The "user agent" is funded by the party it should be neutral toward |
| Third-party cookies, telemetry | Conversation logging, training on your code, usage analytics | Phones home by default; opt-out exists but is buried |
| Manifest V3 | Limits on what hooks, tools, or models you may plug in | The platform decides what your customizations may do |
| Web Environment Integrity | "Approved client" API tiers, model attestation | A remote party decides whether your client is legitimate |
| Pop-up blockers vs autoplay | Permission prompts vs auto-approve agent modes | The safety-versus-friction ratchet, and it always loosens |
| AMP and URL hiding | Not seeing the actual request: full prompt, context, model version | You lose sight of what's really transmitted |
| Brave's affiliate injection | "Privacy-first" tooling quietly monetizing the traffic it routes | Positioning is marketing; incentives are structure |

The one entry without a full twin yet: browsers eventually got standards bodies and a culture of interop. Harnesses have young, incomplete standards — in December 2025, [MCP and AGENTS.md moved under the Linux Foundation's Agentic AI Foundation](https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation), which is roughly where the web was when the W3C was new: a body exists, the wars aren't over. We are somewhere around IE4.

## Six tests for finding out whose agent it is

The useful part of history isn't the outrage, it's the pattern recognition. Each browser scar compresses into a test you can run on any harness today. I've started running them on mine.

**1. Follow the inference money.** Mozilla looked independent; its books said otherwise. The rule from that era: free plus expensive-to-run means someone else is paying, and that someone is the real customer. Inference costs real money. If an agent product is free or implausibly flat-priced, the subsidy is coming from somewhere — training data, an upsell funnel, or ecosystem lock-in.

**2. Check the defaults.** Google doesn't pay billions for a search *option* — it pays for the pre-selected default, because defaults are destiny. On a harness, the day-one state is the honest disclosure: is telemetry on? Is training-on-your-data on? What gets auto-approved? Whatever ships pre-checked is where the money is.

**3. Demand view-source.** The web stayed relatively honest partly because devtools existed — you could always see what a page did and where every request went. AMP was hated precisely because it broke that visibility. Most harnesses fail this test today: you cannot easily see the full assembled request — system prompt, injected context, which files left your machine. "View source for prompts" should be table stakes, and mostly isn't.

**4. Price the exit.** Bookmarks were portable HTML, so switching browsers was painless, which kept vendors honest. Where portability died — extensions, profiles — lock-in lived. For a harness: can you export your conversation history, your agent's memory, your configuration? Does your carefully tuned rules file transfer, or is the format war doing its job?

**5. Find the conflict of interest.** Safari killed third-party cookies instantly; Chrome couldn't, because its owner sells ads. Same feature, opposite speed, explained entirely by business model. So: does your harness vendor also sell the model? The cloud it runs on? The IDE it lives in? Each layer of vertical integration is one more place where neutrality has a price.

**6. Watch the ratchet.** Controversial browser features never arrived mandatory. They arrived opt-in, became default-on, then the opt-out quietly disappeared. Harness releases deserve the same scrutiny version to version: are auto-approve scopes widening? Are permission prompts consolidating into fewer, broader questions? The ratchet tends to turn toward convenience unless users push back — and it turns during minor releases. Smart Tags and Web Environment Integrity prove it can be turned back, but only by people who noticed in time.

## The wells we've already fallen into once

Some browser-era mistakes aren't just parallels — they're predictions.

**The ActiveX well is untrusted local tools — including many MCP installs.** To be precise: MCP itself is a protocol, and a remote server behind scoped OAuth doesn't have this problem. But the common case today — a local server installed from a README, running with your user account and your credentials, security model bolted on afterward — is the ActiveX shape exactly. Prompt injection is the new drive-by download. History says the ecosystem ignores this until one spectacular breach, then over-corrects into a locked-down store model. I'd bet on that cycle repeating here.

**The IE6 well is monoculture.** When one browser won completely, development stopped for years. The escape hatch — Firefox — existed *before* it was needed, kept alive by people who used a worse product on principle. The harness lesson: keep a second one installed and working, even if it's worse. Diversity is insurance you buy before the fire.

**The Chromium well is "open source, closed governance."** Chromium's code is fully open; Google still unilaterally decides things like Manifest V3. License and control are different things. An open-source harness with a single-vendor steering wheel is the same well. The question is never "can I read the code" — it's "who can say no."

**The Smart Tags lesson is the hopeful one.** Twice — Smart Tags in 2001, Web Environment Integrity in 2023 — loud, early, public backlash killed a vendor overreach before it shipped. The defense wasn't technical. It was cultural: enough people watching, complaining early, refusing to treat the overreach as inevitable. That immune system is the thing worth porting to the harness era, and it only works pre-ship.

## What actually worked, and what to demand

Regulation and antitrust matter too — the DOJ ruling and the DMA reshaped real browser behavior — but they operate on decade timescales and you don't get a vote in the courtroom. At the user level, browser history produced three defenses with a track record:

**Backlash before ship.** Covered above. Requires people paying attention to proposals and betas, not just releases.

**Portable formats.** HTML and portable bookmarks enforced exit rights structurally — no vendor promise required. The harness equivalents to push for: convergence on a shared agent-config format, exportable memory, an open transcript format. Every one of these makes the exit-cost test pass by construction.

**Being the actual customer.** Not just paying — paying in a structure where your payment buys alignment. The web's late discovery was the paid product model: you pay, so there's no advertiser to serve. The harness equivalent exists today: bring your own API key, bring your own model. That removes one conflict of interest — the harness no longer profits from routing you to its own model. It doesn't make the harness neutral glass by itself: it can still assemble prompts you don't see, log your code, or retain metadata. BYOK works as a defense only paired with the others — view-source for requests, explicit routing, stated retention policies. Alignment is a stack, not a checkbox.

## Same name, same test

The browser was called a user agent for thirty years, and the interesting question was always whose agent it actually was. The answer was written in the defaults, the deals, and the formats — never in the marketing.

Now there's a new piece of software sitting between me and everything I make, and it's called *my* agent too. Some company built it. I use it. The same test applies, and this time we have the answer key from the last thirty years.