Kitesurf and Obscura: Who Controls the AI Browser?

When people talk about an AI browser today, many first imagine a normal browser with a chat window. An AI summarizes tabs, answers questions, or completes a form. A second category is technically more interesting: browser engines no longer built for people at all. They run without a visible window, are controlled through APIs, and may exist only for the duration of a single task.

My article about WebMCP and the agentic web discussed websites that provide structured functions to agents. Kitesurf and Obscura address the other side of that problem. As long as most of the web lacks an agent interface, AI systems still need an engine that can read and operate ordinary pages.

This is where Cloudflare positions Kitesurf. The new browser runs on Cloudflare Workers, speaks the Chrome DevTools Protocol, and is intended to provide web pages to agents at a much lower cost than a full Chromium process. Its architecture is not the only interesting part. Cloudflare itself says the first prototype was inspired by Obscura, an independent open-source browser written in Rust.

Obscura, however, also pursues another goal. Its optional stealth mode tries to hide common characteristics of automated browsers. Kitesurf does not. On the contrary, Browser Run deliberately marks outbound requests so operators can recognize them as Cloudflare automation and verify them cryptographically.

That raises an uncomfortable question. Did Cloudflare take a good open-source idea, remove the part that was inconvenient for bot detection, and turn it into its own controllable product?

The short answer is: The criticism partly identifies a real conflict of interest, but it is not supported as an explanation for how Kitesurf came about. Technically and strategically, this is more than a sanitized copy of Obscura.

Test basis and limitations

This analysis is based on Cloudflare’s article from August 6, 2026, the current Browser Run documentation, and a code and documentation review of the public Obscura repository on August 25, 2026. Obscura 0.2.1, current at the time, had been released two days earlier. I focused on architecture, network paths, stealth implementation, security notes, release notes, and the separate benchmark repository.

I did not run my own performance measurements against Kitesurf or test production bot challenges. Statements about detection quality therefore come from the implementation, documented limits, and published vendor benchmarks. Where I infer a strategic Cloudflare intention, that is explicitly analysis rather than a confirmed company statement.

What an AI browser must do technically

A conventional browser is a huge general-purpose machine. It renders complex CSS, plays media, accelerates graphics with the GPU, manages extensions, synchronizes profiles, and keeps many tabs stable for hours. Much of that is ballast for an agent that only needs to read a product page, find a button, or create a screenshot.

The agent still needs more than an HTTP client. Modern pages often initially return little more than an almost empty HTML shell. JavaScript constructs the actual content, starts further requests, changes the DOM, and reacts to user actions. A useful AI browser therefore needs at least:

• a JavaScript runtime
• a sufficiently compatible DOM
• network, cookie, and origin logic
• events for mouse, keyboard, forms, and navigation
• an interface for agents and automation tools
• layout, screenshots, and PDF output where required
• hard limits for untrusted code, runtime, memory, and network access

Kitesurf and Obscura reduce Chromium to these agent-relevant parts. Both offer CDP so existing tools such as Playwright and Puppeteer do not need to be rebuilt for a completely new interface. Both execute real JavaScript and construct a live DOM. Both develop their own rendering paths instead of merely launching Chromium with different flags.

That makes them browser engines for automation. The language model, task planning, permissions, and the decision whether an agent may perform an action remain above them. This separation matters. A fast browser does not turn an unreliable agent into a safe one.

Kitesurf: A browser made from Workers

Cloudflare did not build Kitesurf as a single executable. The engine is distributed across several Worker components with different trust boundaries.

Engine, PageScript, and PageRenderer

The Engine Worker is the public entry point. It accepts CDP connections and REST calls and maintains session state. An existing CDP client can therefore address Kitesurf in much the same way as Chrome.

For every page and out-of-process iframe, Kitesurf starts a PageScript Worker. It receives a fresh global JavaScript context and the page DOM. HTML and CSS are processed with components from Blitz and Stylo. Normal JavaScript and WebAssembly execute in the Worker’s V8 isolate.

One notable exception is eval(). Cloudflare Workers do not natively permit dynamic code evaluation for security reasons. Kitesurf therefore uses Boa, an ECMAScript engine written in Rust, to execute such calls inside the Worker environment. This is pragmatic, but it creates a difficult compatibility edge. Some code runs directly in V8, while dynamically generated code passes through a second JavaScript engine that may behave differently.

The PageRenderer Worker produces pixels for screenshots and PDFs. It receives a scene description, rasterizes it, and returns the result. The renderer retains no significant page state. If it hangs or crashes, the engine can discard it and restart the rendering task.

Only one component may access the network

From a security perspective, the SandboxOutbound Worker is particularly interesting. It is the only component allowed to fetch internet resources. It enforces CORS rules, manages cookies separately for each page, filters responses, and adds browser-like headers. PageScript and Engine do not simply receive unrestricted network access.

This is a meaningful difference from many home-grown agent setups. A browser agent does not only open pages a person already trusts. It follows links from search results, foreign documents, or even manipulated prompts. Every page view is untrusted input. The network boundary is therefore not an optimization, but part of the security model.

Kitesurf also uses stateless components wherever possible. A component that holds no state can be terminated and restarted after a failure. This model fits short, highly variable agent workloads well on the Workers platform.

Cloudflare reports more than 215,000 passing Web Platform Tests and good coverage for DOM, HTML, CSS, SVG, Selection, and XHR. The figure sounds impressive, but by itself it does not indicate maturity. WPT consists of files containing many subtests, and Cloudflare publishes neither a complete pass rate nor Kitesurf’s code and exact test configuration. The number therefore cannot be compared cleanly with Obscura’s public WPT runner or Chromium compatibility. Kitesurf was only twelve weeks old when announced and remains a beta.

More efficient, but not faster

Cloudflare’s own measurements reveal the economic attraction. Across a corpus of 14 URLs and five runs, Cloudflare says Kitesurf used 3.1 times less CPU and 4.7 times less memory for screenshots than a warm Chromium pool. For HTML extraction, it used 3.8 times less CPU and 7 times less memory.

Latency was worse at the same time. Screenshots took 1.8 times longer at the median, and HTML extraction 1.7 times longer. Kitesurf therefore mainly saves infrastructure per task. It does not automatically win the race for the fastest individual page.

These figures are useful, but they are not independent benchmarks. Cloudflare selected the corpus, environment, and comparison. A warm Chromium pool is also only one of several operating models. The measurement demonstrates architectural potential. It does not yet prove that Kitesurf is cheaper or more reliable for arbitrary real-world agent workloads.

Obscura: The independent Rust browser

Obscura follows the same basic idea as a local or self-hosted open-source project. Its code is licensed under Apache 2.0. Version 0.2.1 was released on August 23, 2026, and consists of several Rust crates for the CLI, CDP, browser logic, JavaScript, DOM, networking, MCP, and rendering.

V8, a custom DOM, and CPU rendering

Obscura embeds V8 through deno_core. Browser APIs are provided by a large JavaScript bootstrap layer and Rust operations. The DOM is a custom implementation. For layout and rendering, the project uses Taffy, its own browser logic, and a CPU-based paint path, among other components.

Obscura also speaks CDP and includes an MCP server. An agent can open pages, retrieve DOM snapshots, click, fill forms, execute JavaScript, create screenshots, or produce PDFs. Its practical advantage is control: the engine can run locally, in a container, or in private infrastructure. A Cloudflare account is not a technical requirement.

The cost is self-operation. According to the architecture documentation, pages in one process share a V8 isolate, and JavaScript work is serialized through a global lock. Watchdogs and hard deadlines are intended to keep a page from blocking the process permanently. The security document nevertheless states the boundary correctly: these safeguards do not replace operating-system isolation. Anyone processing hostile pages at scale should run Obscura in containers or virtual machines with restricted networking.

That is not a minor caveat. Rust does not protect against every vulnerability in V8, native dependencies, or FFI boundaries. A process that executes arbitrary JavaScript from the internet remains a high-risk service.

Stealth mode is more than a user agent

Obscura’s most interesting difference is its optional stealth build. It replaces the normal reqwest transport with wreq and BoringSSL and emulates a Chrome-like TLS handshake. That includes ClientHello, ALPN, and cipher-suite ordering. This matters because bot systems do not only inspect the visible user agent. They compare whether HTTP headers, the TLS fingerprint, and JavaScript properties tell the same browser story.

On the JavaScript side, Obscura tries to continue that story consistently. Its code emulates navigator.userAgentData, platform values, screen, GPU, Canvas, Audio, battery, and other fingerprint surfaces. navigator.webdriver remains hidden. Internal Obscura properties are concealed from enumeration, and native functions are intended to look like genuine browser functions when inspected through Function.prototype.toString().

It also treats event.isTrusted selectively. An event created by page code with new Event() remains untrusted. Input arriving through the CDP path can be marked as generated by the browser. Returning true indiscriminately would be easy to detect and would also misrepresent normal web behavior.

The stealth path covers navigations, subresources, fetch(), and XHR. This is crucial. If only the main document uses a Chrome-like TLS fingerprint while a later API request suddenly looks like a Rust library, it creates exactly the contradiction bot systems search for.

Obscura additionally blocks known tracking and fingerprinting endpoints. Browser characteristics can vary by session. Its documentation nevertheless warns about inconsistent combinations. IP region, time zone, geolocation, JavaScript profile, and TLS fingerprint must fit together. Rotation is not an invisibility cloak. A single exit IP that constantly switches between different device identities can become even more conspicuous.

Does Obscura really bypass bot detection better?

Compared directly with Kitesurf, Obscura is clearly more focused on anti-detection. That is visible in both code and documentation. It does not follow that Obscura reliably bypasses modern bot defenses.

The project defines its own claim refreshingly clearly. Stealth mode is intended to pass simple TLS fingerprint or user-agent checks. According to the documentation, it does not support:

• interactive Cloudflare challenges
• active challenges from DataDome and Akamai Bot Manager
• CAPTCHAs
• IP-based rate limits

The frequently repeated claim that Obscura gets past bot detection is therefore only correct in a narrow sense. Obscura tries to look less like an ordinary headless client. It is not a universal challenge bypass.

Modern bot systems also assess more than the browser fingerprint. They see IP reputation, ASN, request frequency, navigation, mouse and keyboard patterns, cookie history, account behavior, and relationships across many sessions. A perfectly emulated navigator property helps little when a thousand requests arrive from a data center in the same rhythm.

The public Obscura benchmarks also require caution. The separate benchmark repository contains reproducible scripts for WPT, an obstacle course, real pages, reliability, and stealth consistency. That is better than a marketing table alone. The stealth suite runs locally, however, and primarily tests whether its self-defined fingerprint is internally consistent. It does not prove that major commercial bot systems accept the traffic as human.

The project’s development speed adds another caveat. According to the release notes, 122 commits landed between Obscura 0.2.0 and 0.2.1 in just over two weeks. That shows active development, but also a surface still changing rapidly. No one should infer production maturity for a young browser engine from a successful demo run.

Cloudflare does not want an invisible bot

Kitesurf’s situation is fundamentally different. Cloudflare Browser Run adds non-configurable headers to outbound requests. Web Bot Auth signatures also allow a target server to verify cryptographically that a request came from Cloudflare’s browser infrastructure.

Cloudflare’s FAQ is explicit: Browser Run requests are always recognized by Cloudflare as bot traffic. A website operator decides whether to allow or block them. Anyone automating tests against their own zone can permit the traffic through a targeted WAF rule.

Kitesurf runs as an option within Browser Run. It would therefore be wrong to describe the lack of camouflage only as a technical deficiency. Transparent bot identity is part of the product model. Cloudflare operates both the browser automation platform and the security products with which website operators detect and control bots. Its own browser deliberately undermining those controls would directly damage that model.

Cloudflare also openly states that Kitesurf cannot currently negotiate the bot-challenge handshake with genuine TLS fingerprints. For such pages, it still recommends Browser Run’s Chromium-based default. Yet even this Chromium traffic remains identifiable as automation through Cloudflare headers and signatures.

There is a good case for this choice. Website operators receive a verifiable identity instead of an arbitrarily forged user agent. Legitimate bots can be allowed, measured, or limited selectively. Abuse can be attributed to a provider and infrastructure.

It is still open to criticism. A personal agent reading a publicly accessible page on behalf of a user is technically treated more like a commercial crawler than that user’s browser. The website operator gets a simple switch for excluding Cloudflare agents. The user cannot fall back to a normal, human-looking session, even when merely automating personal research.

Why Cloudflare built its own system anyway

Cloudflare writes that Obscura provided the initial inspiration and was first ported to Workers with the help of an AI agent. Kitesurf grew out of that barely functioning proof of concept. This is clear attribution, not a covert claim that the idea originated in Cloudflare’s own lab.

The proposition that Cloudflare rejected Obscura because of its stealth function appears neither in the Kitesurf article nor in the Browser Run documentation. Several more visible reasons exist.

Obscura is built as a self-hosted process. Kitesurf is designed as a distributed Workers application. Cloudflare wants to use isolates, Service Bindings, Worker RPC, its own outbound sandbox, and existing Browser Run APIs. Merely starting a Rust binary somewhere would not achieve that.

Cloudflare also needs an engine whose lifecycle, resource use, telemetry, and failure behavior fit its platform. A stateless renderer discarded after a faulty RPC represents a different operating architecture from a process with a shared V8 isolate and global lock.

Finally, Kitesurf is a product component. CDP makes the client relatively portable, but the service itself remains closely tied to Browser Run and Cloudflare Workers. Cloudflare promises to open-source Kitesurf later and let customers deploy it in their own Cloudflare accounts. Today, however, the code is not public. Obscura’s architecture, security boundaries, and implementation can be inspected now. Kitesurf can currently be judged only by its published design, documentation, and observable behavior.

This is where criticism is justified. Cloudflare benefits from an open idea and an existing project while keeping its own development closed initially. Apache 2.0 permits that, and Cloudflare explicitly names Obscura. It is legally clean. For a company promising an imminent release, however, the published code will ultimately matter more than the word “soon.”

Two browsers, two control models

The most important differences cannot be reduced to speed.

Kitesurf is therefore not simply a better Obscura. It solves a different operational problem. Cloudflare wants to execute many short-lived browser tasks safely and cheaply on its platform. Obscura wants to provide an independent browser engine that operators control themselves and can make less readily detectable when necessary.

The unresolved security question sits above the browser

Both projects invest heavily in isolating websites. That is necessary, but it does not solve the most important risk of an AI browser: a website can manipulate the agent itself.

Prompt-injection text in the DOM does not need to trigger a V8 sandbox escape. It is enough for the model to interpret it as an instruction, disclose internal data, open a malicious link, or use a powerful tool. Network isolation protects browser infrastructure. It does not automatically protect the user’s intention.

A production-ready agent browser therefore needs additional controls:

• separate browser contexts for unrelated tasks
• minimal secrets and short-lived tokens per session
• explicit approval before login, purchase, upload, or data modification
• domain and egress rules outside page JavaScript
• logs that connect model decisions, browser actions, and results
• a safe abort path for unexpected navigation and downloads
• protection against page content becoming system instructions

Cloudflare names prompt injection and tool safety as priorities, but its Kitesurf article mainly describes browser isolation. Obscura provides browser tools but does not authorize the agent above it. Anyone deploying either project must close this gap themselves.

Which model suits which use case?

Kitesurf is interesting for screenshots, HTML extraction, or documents from approved pages you control. Its Workers architecture reduces operational effort, and transparent bot identity is no obstacle in your own environment. Operators can allow Browser Run selectively and retain traceable provenance.

Obscura is more attractive for local research, internal automation, or environments with strict data-control requirements. The engine then belongs in a carefully constrained runtime. Containers or VMs, restrictive egress, separate credentials, and enabled --obey-robots should not be afterthoughts.

For long authenticated sessions, media, WebGL, or sites with complex bot defenses, a real Chromium browser often remains the more realistic choice. Cloudflare says this openly for Kitesurf as well. A smaller browser is not automatically a more compatible browser.

Stealth functions should be used only for legitimate, authorized testing or privacy-oriented automation. Technical accessibility answers neither the legal question nor whether a site’s rules, rate limits, and resources are being respected.

My conclusion

Obscura clearly showed Cloudflare that an agentic browser does not necessarily have to be Chromium. Kitesurf takes this basic idea and builds a Workers-native architecture with compelling isolation, lower resource consumption, and direct Browser Run integration.

Obscura is genuinely more aggressive on bot detection. Its stealth mode models TLS, HTTP, and JavaScript surfaces much more deliberately than Kitesurf. “Better at bypassing” is still too broad a claim. Better camouflage against simple fingerprint checks is supported. The project itself disclaims bypassing modern interactive challenges.

Cloudflare’s restraint is not merely technical immaturity. Browser Run is intended to be recognizable as a bot. Non-removable headers and Web Bot Auth make this transparency a product feature. That fits a company that sells Bot Management on the other side. It also prevents Kitesurf from becoming an independent browser acting solely on the user’s behalf.

The strongest criticism is therefore not that Cloudflare simply copied Obscura. The architecture and operating models differ too much, and Cloudflare openly acknowledges the inspiration.

The stronger criticism is this: Cloudflare is building an AI browser whose identity, runtime, distribution, and access all fit Cloudflare’s control model. That can be entirely reasonable for operators. For an open, user-centered agentic web, however, it is only one possible answer.

Whether Kitesurf truly becomes open, how complete the released code will be, and whether the browser can be operated meaningfully outside Cloudflare’s platform remain to be seen. Until then, Obscura is the more open experiment and Kitesurf the better-integrated product.

Until next time,
Joe