AIClaw and Nabsun let AI agents drive real browser tabs via indexed elements

Two projects, one approach

Two open-source projects surfaced on dev.to on the same day with the same answer to a familiar annoyance: AI assistants live in a chat window while the actual work sits in browser tabs. AIClaw 3.5 bolts element-indexed browser tools onto an existing local desktop agent; Nabsun is a browser with the assistant built in. Both let a model act on live pages through structured element references instead of screen coordinates or copy-paste.

AIClaw: numbered elements instead of pixels

According to its dev.to post, AIClaw 3.5 registers ten browser tools when the feature is enabled: navigate, snapshot, click, type, select, scroll, back, key, extract and screenshot. The centerpiece is browser_snapshot, which returns a numbered list of interactive elements, each carrying its role, visible text, current value for inputs, link target and whether it is on screen. The list stops at 150 entries but reports the total, so the model can tell there is more below and keep scrolling rather than stop early.

The design follows browser-use: the model acts on element numbers rather than clicking at coordinates, which go stale the moment a page reflows. A screenshot tool exists for layout puzzles and captchas, but it is not the default path. The tools also fold into AIClaw's code-execution mode, so tasks like paging through result lists run as loops whose intermediate pages never enter the context window.

Since AIClaw is an Electron app, it reuses the bundled Chromium — no Playwright, no separate browser download. The agent drives a visible BrowserWindow on a persistent partition, so sign-ins persist across sessions, the user can step in mid-task, and the page cannot reach the preload script or Node. Typed text goes through the real input path, which framework-controlled inputs in React and Vue actually register.

Nabsun: the assistant lives beside your tabs

Nabsun starts from the browser side. It is an MIT-licensed, developer-preview browser built on Chromium and Electron, with a side-panel assistant that reads the page you are on, compares tabs and acts inside your existing signed-in session. The assistant sees pages through an accessibility-derived outline; interactive elements receive opaque references that are handed to click, type and select tools. The page bridge rejects stale references and changed element identities instead of firing actions at the wrong target. Coverage is uneven — iframes and shadow roots are partial — and the post is explicit that not every model will complete every site workflow.

The model layer is pluggable: a bundled Qwen3 1.7B runs locally on CPU with no account, or you can point it at Ollama, Anthropic or OpenAI APIs, or connect the Codex or Claude Code CLIs. Nabsun also runs an MCP server on loopback with a fresh bearer token per launch, letting external agents use its browser tools against your open tabs under the same approval settings.

Trust boundaries in a signed-in session

Both posts spend real effort on what an agent inside your session may do. AIClaw asks for approval on every navigation — leaving the machine is the risky step — while in-page writes follow the active profile (the default allows them, the strict one prompts per action), read-only tools never ask, unattended channel sessions cannot touch the browser, and only http, https and data: URLs load. Scraped content is wrapped in untrusted-input boundary markers so a sentence on a page cannot be read as an instruction, though a page that disguises one control as another remains out of scope. Acknowledged gaps include file upload, placeholder substitution for secrets, multi-tab support, a domain allowlist and headless mode.

Nabsun runs reading tools automatically but gates clicking, typing, navigation and page code by default, with per-tool grants and an Autopilot mode that also covers connected agents. Passwords and one-time codes are excluded from structured extraction, and typing into those fields is blocked. The limits are stated plainly: prompt injection is still possible, plugins and MCP servers run unsandboxed with full Node privileges, Stop cannot undo a completed action, there has been no independent security audit, Windows builds are unsigned, and auto-updates, profile sync and private browsing are missing.

Why it matters

Element indexing is settling in as the standard interface between agents and the web — cheaper than screenshots, sturdier than coordinates, and loop-friendly in a way that keeps context windows small. What these two releases push further is location: the action happens in your real, authenticated browser rather than a disposable automation profile. That concentrates value and risk in the same place, which is presumably why both projects chose permissive open-source licensing — an assistant that can see private documents and logged-in apps is exactly the software you want to be able to read.