Cloudflare threw out Chromium and wrote a browser for robots

😁 Hello, super humans! Every agent that browses the web today is driving a car built for a human: Chromium, with its JIT, its GPU compositor, its tab bar, and its 270 megabytes of resident memory. Cloudflare looked at that bill and did the unreasonable thing: it wrote a new browser engine from scratch, in Rust, and squeezed it into a V8 isolate. Let’s get into how.

📰 Quick Signals

• 🧠 AI: Follow-up on last week’s Google DeepMind shake-up: Fortune reports the exit followed stalled models, missed deadlines and a talent exodus, not just a change of title.
• 🤖 Robotics: Defense drone developer Cambridge Aerospace raised $300 million, only months after closing a $200 million Series B in April.
• 💻 Programming: CISA added Langflow’s CVE-2026-9198 to its Known Exploited Vulnerabilities catalog: an unauthenticated token endpoint chained to a code-validation endpoint gives full remote code execution, CVSS 9.8.
• ⚡ Electronics: Global semiconductor sales hit $403.3 billion in Q2 2026, up 35.1% on Q1, with the SIA now expecting the year to clear $1.5 trillion.
• 📡 Telecom: The GSA counts 313 completed, planned or ongoing 2G and 3G switch-offs across 89 countries as operators refarm that spectrum into LTE and 5G.

🔍 The Big Story: Cloudflare wrote a browser engine for agents, and left Chromium out of it

If you have ever run a fleet of browser-using agents, you already know the shape of the bill. It is not tokens. It is the hundreds of megabytes each headless Chromium instance parks in RAM while your agent does something as trivial as reading a page and taking a screenshot.

What happened: On 7 August, Cloudflare announced Kitesurf, a headless browser built specifically for agents that runs entirely on Cloudflare Workers, with no Chromium underneath. The engine is written from scratch in Rust, compiled to WebAssembly with wasm-bindgen, and executes inside V8 isolates. It is free while in beta through Browser Run, and it speaks the Chrome DevTools Protocol, so existing Puppeteer, Playwright, chrome-remote-interface and MCP clients point at it unchanged.

The details: The architecture is the interesting part. Every page gets its own Dynamic Worker holding a PageScript isolate with a clean globalThis and a DOM document. HTML and CSS parsing comes from Blitz and Stylo, Firefox’s CSS engine, both already Rust. Workers still do not support eval, so Cloudflare runs Boa, an ECMAScript engine written in Rust, as a runtime on top of the runtime for the rare page that needs it. Rasterization lives in a separate stateless PageRenderer Worker reached over Worker-to-Worker RPC, which means a stuck render can simply be killed and retried. The published medians across a 14-URL corpus: a screenshot costs 380 ms of CPU against Chromium’s 1,173 ms, HTML extraction 229 ms against 877 ms, and memory lands at 57.8 MiB and 39.4 MiB against Chromium’s 271.0 MiB and 273.7 MiB. Wall time is the one loss: Kitesurf is about 1.7x to 1.8x slower, because a warm JIT beats a cold software renderer every time.

flowchart LR
    A["Puppeteer / Playwright<br/>MCP client"] -->|CDP| B["Engine Worker"]
    B --> C["PageScript isolate<br/>clean globalThis + DOM"]
    C --> D["Blitz + Stylo<br/>HTML / CSS parse, Rust"]
    C --> E["Boa JS<br/>eval fallback"]
    B -->|RPC| F["PageRenderer Worker<br/>stateless, disposable"]
    F -->|PNG| B
    C -.->|untrusted page| G["Isolated fetch<br/>arbitrary origins"]

🗞️ More News

🧠 AI

• Article 50 of the EU AI Act became enforceable on 2 August with no grace period: every chatbot serving EU users must disclose it is an AI at first contact, with fines up to 15 million euros or 3% of global turnover.
• The Cloud Security Alliance published a research note on what Article 50 actually demands in code, including the machine-readable provenance labels most teams have not implemented yet.
• Amazon Bedrock AgentCore added EC2-backed runtime instances: agent sessions that persist up to 14 days instead of 8 hours, with GPU acceleration, session stop and restart, and multiple agents sharing one host.
• More than 30 companies joined an NVIDIA-led Open Secure AI Alliance formed after last month’s agent-breach disclosures, with OpenAI, Google and Anthropic all conspicuously absent from the member list.
• EvoHarness-RL proposes a runtime harness that evolves its own scaffolding during a long-horizon run rather than shipping a fixed control loop.
• StructAgent attacks the same long-horizon problem from the other side, giving digital agents an explicit causal structure over their action history instead of a growing transcript.

🤖 Robotics

• PlusAI reported six months of safety-validation and operational milestones on factory-built trucks with its global OEM partners, ahead of launching SuperDrive commercially.
• Hadrian raised $1.37 billion at a $7.87 billion valuation for its software-run defense and aerospace factories, its second round this year.
• VicOne released a free Radeis extension for NVIDIA Isaac Sim, built on DEF CON 34 research, so you can test a robot’s cyber safety in simulation before it touches a real factory network.
• RoboStore, which has put Unitree legged robots in front of more than 4,000 US customers, spun up Robo Inc. as a US-based manufacturer and integrator.
• Tate replaced hand welding with 58 Hirebotics cobot welders across multiple facilities, wired into one cloud-connected automation network.

💻 Programming

• Check Point disclosed 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, and they are not prompt-injection bugs: insecure deserialization, SSRF, path traversal and use-after-free, in the middleware.
• Roughly 7,000 internet-facing Langflow servers are being actively probed, and the same class of hole sits in LangGraph and LangChain deployments.
• Kodem walked through the equivalent issues on the JavaScript and TypeScript side of those frameworks, which get far less scrutiny than the Python packages.
• SecureLayer7 published a comparative security review of the major agent frameworks, useful if you are picking one this quarter rather than patching one.

⚡ Electronics

• With the RVA23 profile ratified, RISC-V is moving past embedded: EE Times reports server-class parts up to 128 cores aimed squarely at Arm and x86 in the data centre.
• The memory squeeze is pushing IoT designers toward RISC-V parts for a reason that has nothing to do with ideology: availability and unit cost.
• Framework customers learned about a Metabase-related data breach mostly by forwarding each other the email, since the company has yet to post a public acknowledgement.
• Hackster’s Embedded World field report picks out ST’s ST64UWB ultra-wideband SoC with Aliro smart-lock support and TI’s TinyEngine NPU for ultra-low-power on-device inference.

📡 Telecom

• Behind the headline number: 158 of those legacy network closures are finished, 119 are scheduled, and 139 operators across 70 countries have now committed to a 2G shutdown date.
• The FCC has cleared AST SpaceMobile’s full 248-satellite constellation, but a launch setback is clouding how fast the company can actually get there.
• Awkward detail from the 5 August BlueBird launch: AST paid roughly $74 million to SpaceX, its most direct competitor, to put satellites 11 through 13 in orbit.
• The AT&T and Verizon satellite beta is getting closer, with the honest caveat that early coverage gaps will be measured in hours, not minutes.

👨‍💻 Code Corner

Because Kitesurf speaks the Chrome DevTools Protocol, switching an existing Puppeteer script over is a query-string change. Set CF_ACCOUNT and CF_TOKEN, then run this to compare both engines on the same page:

import puppeteer from "puppeteer-core";

const base = `wss://browser.cloudflare.com/v1/acct/${process.env.CF_ACCOUNT}/cdp`;

async function grab(engine) {
  const browser = await puppeteer.connect({
    browserWSEndpoint: `${base}?browser=${engine}&token=${process.env.CF_TOKEN}`,
  });

  const t0 = performance.now();
  const page = await browser.newPage();
  await page.goto("https://news.ycombinator.com", { waitUntil: "load" });

  const titles = await page.$$eval(".titleline > a", (as) =>
    as.slice(0, 5).map((a) => a.textContent)
  );

  await page.screenshot({ path: `hn-${engine}.png` });
  await browser.close();

  return { engine, ms: Math.round(performance.now() - t0), titles };
}

for (const engine of ["kitesurf", "chromium"]) {
  console.table(await grab(engine));
}

🧰 Toolbox

• Browser Run: the Cloudflare product Kitesurf ships inside, with CDP endpoints and one-shot Quick Actions for screenshots, HTML and PDFs.
• Blitz: the modular Rust rendering engine doing Kitesurf’s HTML and CSS layout, usable on its own if you want a browser-shaped thing without a browser.
• Stylo: Firefox’s production CSS engine, extracted as a Rust crate anyone can link against.
• Boa: an embeddable ECMAScript engine written in Rust, handy when you need to run untrusted JavaScript somewhere that has no eval.
• obscura: the “no Chrome, no Node.js, no dependencies” headless Rust engine that gave Cloudflare the original idea.
• Awesome-Long-Horizon-Agents: a curated roadmap of the papers and harnesses tackling agents that have to work for hours.

🎬 Demo Watch (rotating)

LongHorizon-Harness: Advancing Long-Horizon Agents for Real-World Tasks

The failure mode this paper targets is one you have probably watched live: an agent works fine for twenty minutes, then quietly convinces itself it finished a step it never did, and everything after that is built on the lie. The authors argue the root cause is architectural. Most harnesses keep the task state, the execution and the self-assessment all inside one growing context, so a wrong self-assessment becomes an input to every later decision.

Their fix is to pull the state out of the context entirely. A Manage-Execute-Audit loop runs a manager that owns the task state and picks the next subtask, a fresh-context executor that does only that subtask, and a read-only auditor that verifies progress against the environment. State is updated only with facts the auditor independently confirmed, never with the executor’s opinion of itself. An AgentAdapter layer lets you bolt this onto existing backends.

What makes it worth a read rather than a skim are the deltas: Qwen 3.7-Plus goes from 51.8% to 80.7% on WeaveBench, 69.7% to 77.2% on Terminal-Bench 2.1, and 2.8% to 8.3% on OSWorld 2.0, while Claude Opus 4.7 goes from 20.0% to 34.3% on an OSWorld 2.0 subset. Same models, same tasks, different plumbing. The hype-versus-real line is easy to draw here: nothing got smarter, the scaffolding just stopped lying to itself, and that was worth 29 points.

📚 From the Blog

• Turning Pixels Into Something the AI Can Eat: the preprocessing layer between a camera feed and a model, and why most of the cost hides there. Same lesson as today’s Big Story: the expensive part is rarely the model.
• Building Your First Neuron From Scratch: weights, bias, activation and a training loop written by hand, with no framework hiding the maths.
• The Network Behind the Cameras: the unglamorous plumbing that moves video across a network without melting it.

😀 The Bot Says…

Chromium needs 271 MiB to take one screenshot. That is more memory than the entire Space Shuttle flight software, the original Doom, and Windows 95 combined, spent on a picture of Hacker News. In fairness, the comments were probably worth it.

---

That’s all for today! If you swap an agent onto Kitesurf and something renders hilariously wrong, reply with the screenshot.