The Agentic Browser: AI Employees That Operate Legacy Software With No API

Walk into almost any German manufacturer, insurer, or logistics company and you will find the same quiet scene: a skilled employee with three windows open, retyping numbers from one system into another by hand. The data already exists. It just lives in software that has no API, no connector, and no way to talk to anything else. So a person becomes the integration layer.

This is the problem the agentic browser was built for. Instead of waiting for a legacy vendor to ship an API that may never come, a new class of AI employee simply does what the person does - it looks at the screen, moves the cursor, clicks, types, reads the result, and moves on. In 2025 this stopped being a research demo and became a shipped product from Anthropic, OpenAI, and Google.

This guide is for the operations leader, CTO, or Geschaeftsfuehrer who has heard the words “computer use” and wants the honest version: what it actually is, where it works, where it still fails, and how it fits the systems your company already runs. No hype, and no pretending a screenshot-and-click agent is magic.

The API Gap: Why Your Most Important Software Can’t Be Automated

Every automation vendor assumes your systems have a clean API. The companies doing real work know better. The software that runs the shop floor, the claims desk, and the customs filing is often a decade or two old, on-premise, licensed per seat, and completely closed. That is the gap where productivity goes to die.

• Connecting AI to existing systems is the number one blocker - 95 percent of organisations report difficulty connecting AI to their existing systems, and 83 percent say integration challenges slow their digital progress outright⁹.
• Almost nothing is actually integrated - Only 2 percent of organisations have successfully integrated more than half of their applications. The rest run as islands⁹.
• Legacy is the norm, not the exception - 92 percent of organisations are weighed down by technical debt from legacy systems that were never designed to connect to anything¹⁰.
• Regulated industries are the worst hit - Around 70 percent of banks name integrating with legacy systems as a major obstacle, and many of those systems do not even support modern authentication⁹.
• The old core is not going away - The mainframe modernisation market alone is growing from 18.12 billion dollars in 2025 to 20.85 billion in 2026, which tells you how much business still runs on systems too critical and too entangled to rip out¹².
• People are the current workaround - When two systems cannot talk, a human copies between them. That is slow, error-prone, and the first thing that breaks when someone is on holiday.

The traditional answers are expensive and slow: replace the legacy system (a multi-year project), build custom middleware (if an interface exists to build against), or pay for RPA bots that break whenever a screen changes. The agentic browser offers a fourth path - operate the system through the one interface it always has, the screen.

What an Agentic Browser Actually Is (and What It Is Not)

“Agentic browser” and “computer use” describe the same thing: an AI agent that operates a graphical interface the way a human does. It is worth being precise, because the term gets stretched to cover tools that are really just chatbots or recorded macros.

Technically, the agent runs a loop. It takes a screenshot, a vision model reads the interface and locates buttons and fields, the language model decides the next action toward the goal, it executes a click, keystroke, or scroll, and then it takes another screenshot to check the result before continuing. Anthropic calls the repetition of these steps without user input the “agent loop”¹.

The difference from RPA and chatbots

The key distinction from RPA is reasoning. RPA replays a recorded sequence and, as Gartner puts it, has zero ability to reason, so it can fail silently or process the wrong data when something shifts¹⁵. An agentic browser looks at what is actually on the screen each time and decides, which is why a moved button does not end the run.

What it looks like in practice

• Reading an old ERP - The agent opens your on-prem ERP, navigates to an order, reads the delivery date and quantity off the screen, and writes them into the modern system your team actually uses.
• Filling a portal - It logs into a supplier or customs portal, enters the required fields from your data, submits, and captures the confirmation number as proof.
• Working a desktop tool - It operates a licensed Windows application that has never had an API, clicking through the exact steps a trained operator would.
• Checking its own work - After each action it takes a fresh screenshot and confirms the screen shows what it expected before moving on, rather than assuming.

Why This Became Real in 2025, Not 2020

Screen automation has existed for years, but it was always brittle because it could not understand what it was looking at. Three shifts changed that, and all of them landed as shipping products within a single year.

1. OpenAI shipped Operator - In January 2025 OpenAI released Operator, powered by a Computer-Using Agent model built on GPT-4o that interacts with interfaces through simulated mouse and keyboard input. Industry analysts noted it was explicitly aimed at reaching AI agents without APIs^2,8,16.
2. ChatGPT agent generalised it - In July 2025 OpenAI folded that capability into ChatGPT as “agent mode,” combining website operation with research and multi-step task execution for Pro, Plus, and Team users³.
3. Anthropic made it a developer tool - Claude’s Computer Use lets developers build agents that take screenshots, move the cursor, click, and type inside their own infrastructure, with an explicit set of member actions for the full agent loop¹.
4. Google optimised for the browser - In October 2025 Google released the Gemini 2.5 Computer Use model through its API, AI Studio, and Vertex AI, tuned for web and mobile interfaces and already powering Project Mariner^4,5.
5. The vision models got good enough - The missing piece was a model that could actually read a cluttered enterprise screen and locate the right field. That is now solved well enough for real work, even if not perfectly.
6. The market is pricing it in - Gartner expects 40 percent of enterprise applications to feature task-specific AI agents by the end of 2026, up from under 5 percent in 2025¹⁴.

The capability is real and broadly available. What is not yet solved is reliability on hard, open-ended work, which is exactly where the honesty has to come in.

Where Computer Use Is Reliable - and Where It Is Not

This is the section most vendor blogs skip. An agentic browser is powerful on the right task and a liability on the wrong one. The difference comes down to how constrained, stable, and verifiable the task is.

The reliability reality

• Agents only just reached the human baseline - On OSWorld, a benchmark of 369 real tasks across browsers, office apps, and file systems, human performance is 72.36 percent. An agent first matched it at 72.6 percent in December 2025^6,7. On hard end-to-end work, the ceiling is roughly human, not superhuman.
• Browser tasks run better than desktop - Google tuned its model for web and mobile and was explicit that desktop OS control is not yet optimised, which tells you where the frontier still is^4,17.
• Latency is real - Google reports around 225 seconds of latency on its benchmark harness. That is fine for overnight batch work, not for anything a customer is waiting on live⁴.
• Prompt injection is a genuine risk - Anthropic warns that Claude may follow instructions hidden in a webpage or image even when they conflict with yours, so an agent browsing the open internet can be manipulated¹.
• Fiddly controls trip it up - Dropdowns and scrollbars are called out as tricky to manipulate, and clicks can miss small targets when a screenshot is downscaled¹.
• It assumes success if you let it - Anthropic notes the model sometimes assumes an action worked without checking, which is why forced verification after each step matters¹.

Agentic Browser vs API vs MCP vs RPA: Choosing the Right Connection

The agentic browser is not a replacement for every other way of connecting AI to a system. It sits at the bottom of a priority order: use the cleanest connection available, and drop down a level only when you have to.

1. Direct API first - If the system has a documented API, use it. It is the fastest, most reliable, and most auditable option, full stop.
2. MCP where you can - A Model Context Protocol connector gives the agent structured, governed access to a system through a defined interface, which is cleaner than operating the screen.
3. Agentic browser when there is no door - For the legacy and on-prem systems with no API and no MCP server, the screen is the only interface, so you operate it.
4. RPA for stable, high-volume repetition - Where a rigid, high-throughput script already runs reliably and the UI never changes, keep it.

The mistake is treating the agentic browser as a silver bullet. The right design mixes all four methods and reserves screen operation for where it is genuinely the only option. If you want the deeper comparison of structured connections, we cover it in our guide to MCP connectors.

9 Real Legacy Scenarios an Agentic Browser Can Handle

The abstract idea becomes concrete fast once you look at the systems a typical Mittelstand company actually runs. Here are nine recurring situations where no API exists and the screen is the only way in.

• Order entry into an old ERP - Reading incoming orders from email or a modern tool and keying them into a 15-year-old on-prem ERP that has no import function.
• Customs and export filings - Logging into a government portal, filling the declaration from your shipment data, and saving the reference number as audit evidence.
• Supplier portal updates - Checking order status and confirming deliveries across a dozen different supplier web portals, each with its own login and layout.
• Insurance claim intake - Transcribing claim details from PDFs and emails into a closed claims-management desktop application.
• Bank and payment portals - Pulling statements or entering payment runs in a banking portal that offers no feed, with a human approving before anything is sent.
• Warranty and RMA processing - Creating return authorisations in a manufacturer system that only exists as a web UI behind a partner login.
• Master data maintenance - Updating prices, part numbers, or customer records across systems that will never share a database.
• Reporting from a terminal - Reading figures off a green-screen terminal or mainframe emulator that the last specialist is about to retire from.
• Cross-system reconciliation - Comparing what one system says against another, line by line, and flagging the mismatches a human needs to resolve.

How to Deploy an Agentic Browser Employee Safely

The capability is the easy part. The difference between a useful agent and a dangerous one is entirely in how you scope it, constrain it, and supervise it. Here is the practical sequence.

1. Pick one no-API workflow - Start with a single, well-understood process where no cleaner connection exists. Resist the urge to automate five things at once.
2. Map the real steps, including exceptions - Watch the person do it. Capture the clicks, the edge cases, and the unwritten rules nobody documented. This is where most generic agents fail.
3. Encode the company knowledge - The agent has to know your approval thresholds, naming conventions, and what each field means. That context lives in the Company Brain, not in a prompt someone retypes.
4. Lock down the environment - Run the agent in a dedicated virtual machine with minimal privileges, restrict internet access to an allowlist, and keep credentials out of the model, as Anthropic recommends¹.
5. Force verification after every step - Make the agent screenshot and confirm the result before continuing, so it never assumes a click worked¹.
6. Set human-in-the-loop checkpoints - Require a person to approve any action with real financial or legal consequence before it is committed.
7. Run in parallel first - Let the agent shadow the existing process and compare outputs before it touches anything live.
8. Log everything - Keep a full audit trail of every screenshot, decision, and action, so any mistake is traceable and correctable.

How Superkind Fits

Superkind builds AI employees that live inside the systems a company already uses - one layer over everything, no island solution and no tool chaos. The agentic browser is simply the part of that layer that reaches the systems with no API. It is never the whole story, because knowing how to click is worthless without knowing your business.

• Driven by the Company Brain - The agent operates your screens using your processes, your data, and your rules, not a stranger’s guess about how your ERP works.
• API and MCP first, screen when needed - We connect through the cleanest interface available and use the agentic browser only for the legacy systems that have no other door.
• Works your real stack - SAP, Salesforce, HubSpot, DATEV, Outlook, SharePoint, and any API-based software, plus the closed systems that only have a screen.
• Process-first discovery - We map how the work actually happens, exceptions included, before anything is automated.
• Guardrails as standard - Isolated environments, least privilege, forced verification, and human checkpoints for anything high-stakes.
• Live in weeks, not months - A single no-API workflow goes into production in 8 to 12 weeks, with no integration project to wait on.
• DSGVO-ready deployment - Data stays inside your infrastructure, with full audit logging of every action the agent takes.
• Outcomes, not seat licences - Pricing is tied to the work done, not the number of logins, which avoids the seat-based software trap.

Decision Framework: Should You Use an Agentic Browser?

Not every automation problem calls for screen operation. This framework helps you decide whether an agentic browser is the right answer or the wrong one.

Frequently Asked Questions

Related Articles

• MCP Connectors Explained: How to Connect AI Agents to ERP, CRM and SharePoint in 2026
• The Copy-Paste Economy: How Much of Your Team’s Day Is Just Moving Data Between Systems
• Data Gravity: Why Your Company Knowledge Should Live Where Your AI Works
• The Seat-Based Software Trap: How to Get More Output Without More Headcount
• Build vs Buy: Should You Build Your Own AI Agent or Buy a Platform?
• The Company Brain Ramp-Up Curve: How Long Until AI Actually Knows Your Business

Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI agents that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. He has spent a lot of time with mid-sized businesses whose most important software has no API, and he believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach.