Cloudflare Kitesurf: Lightweight Browser Runtime for AI Agents

Every browser you’ve ever used — Chrome, Firefox, Safari, the one on your phone — was built around a person sitting in front of a screen. Tabs, smooth scrolling, extensions, pixel-perfect fonts: all of that exists because a human is looking at it. On 6 August 2026, Cloudflare shipped something built around a different assumption entirely. Kitesurf is a web browser with no human-facing features at all, designed from the ground up to be operated by AI agents rather than people, and it doesn’t contain a single line of Chromium’s code.

The problem Kitesurf is trying to solve

AI agents that browse the web — filling in forms, extracting data from pages, taking screenshots to “see” what’s on screen — have always done it by remote-controlling a real browser. Usually that browser is Chromium, running headless on a server somewhere, driven by tools like Puppeteer or Playwright. It works, but it’s expensive: a full Chromium instance uses meaningfully more memory and CPU than the task actually requires, because most of what Chromium does — rendering fonts at 60 frames a second, keeping multiple tabs alive, managing browser extensions — exists for a human’s benefit, not an AI’s.

Cloudflare’s argument is that this overhead adds up fast when every agent needs its own browser instance, and that cost is what’s kept large-scale agentic browsing limited to well-funded operations that can absorb it. Their fix wasn’t to trim Chromium down. It was to not use Chromium at all.

What Kitesurf actually is

How a page actually gets rendered without a browser engine

Cloudflare structures Kitesurf as several separate Cloudflare Workers talking to each other over a built-in remote procedure call system, rather than one monolithic program — a structure that only became possible once Cloudflare’s own platform grew features like Dynamic Workers and Worker-to-Worker RPC. One piece handles network access, and three more — which Cloudflare itself calls the “three main components” — handle the actual browsing.

Fetching the page

A single component called SandboxOutbound is the only part of Kitesurf allowed to make network requests. Every image, script, stylesheet, and font a page needs gets pulled through this one chokepoint, which enforces CORS rules, strips or rejects anything that fails policy, and keeps each page’s cookies isolated from every other page’s. Nothing else in the system can reach the open internet directly.

The Engine

The Engine is the only public-facing part of Kitesurf, and the only one of its components that holds any state. It’s what actually handles the Chrome DevTools Protocol connection — the thing that lets Puppeteer, Playwright, and CDP-speaking AI agents talk to Kitesurf as if it were a normal browser — and it keeps track of each session while every other component stays disposable and stateless.

PageScript

For each page, the Engine spins up a dedicated PageScript Worker using Cloudflare’s Dynamic Workers feature — using Blitz to parse the HTML and Stylo to parse the CSS — which then runs any JavaScript on the page inside that same isolated environment for the life of that page’s session. This is also where the eval() workaround comes in: since Workers don’t support native JavaScript evaluation for security reasons, Kitesurf routes any eval() calls through Boa JS instead.

PageRenderer

PageRenderer takes the finished page structure and actually paints it into a viewable image — a JPEG, PNG, or PDF — using another part of Blitz called blitz-paint, paired with a font-shaping library called Parley. This is the step that produces the screenshot an AI agent actually looks at, and unlike PageScript, it’s entirely stateless: it holds no memory of any page, so the Engine can kill and relaunch it the instant a render call fails or stalls, with nothing lost in the process.

The actual numbers

Cloudflare published benchmark results comparing Kitesurf against a warm pool of Chromium instances, averaged across five runs over a 14-URL test set:

The pattern is consistent: Kitesurf is dramatically lighter on memory and CPU — the two things that actually determine hosting costs at scale — but it’s slower in raw elapsed time. Cloudflare attributes most of that gap to image rasterization and JPEG/PNG encoding, and says it’s an area they’re still optimizing. A pre-warmed Chromium instance with a JIT compiler that’s already seen a given page will generally win a straight speed race against a cold software renderer; Kitesurf’s bet is that CPU and memory savings matter more than shaving milliseconds off a single page load, especially at the volume agentic workloads tend to run at.

On standards compliance, Cloudflare reports Kitesurf passing more than 215,000 Web Platform Tests — the same conformance suite real browser vendors use — with particularly strong coverage in the areas that matter most for agent tasks: DOM manipulation, HTML parsing, CSS selection, SVG, and XHR.

What it can’t do yet

Cloudflare is explicit about the current gaps, and they’re not small ones for anyone expecting a Chromium replacement:

• No video playback
• No WebGL rendering
• Can’t negotiate a real TLS fingerprint, so it will fail on sites using bot-detection handshakes
• Not built for long-lived, authenticated sessions that need to persist state over many minutes

For any of those, Cloudflare’s own documentation says to fall back to Browser Run’s standard Chromium-backed option, which remains available alongside Kitesurf rather than being replaced by it.

Why this matters beyond one company’s product launch

The interesting part isn’t really the specific performance numbers — those will keep moving as Cloudflare optimizes the renderer. It’s the underlying bet: that as AI agents doing real work on the open web becomes normal rather than experimental, the browser itself becomes infrastructure worth rebuilding from scratch for that specific user, the same way a CDN gets rebuilt when the traffic pattern it serves changes. Kitesurf is Cloudflare’s answer to a fairly specific engineering question — what a browser looks like once you design it for a machine reader instead of a human one — and stripping out tabs, extensions, and pixel-perfect rendering is what that answer looks like once you actually try building it.

Whether that bet pays off depends on something Cloudflare’s own benchmarks can’t settle: how much of the real, messy web — sites with bot detection, video content, WebGL dashboards, long authenticated sessions — an agent actually needs to touch day to day. For the narrower slice of tasks Kitesurf targets now — screenshots, structured data extraction, one-shot page reads — the CPU and memory savings are real and independently checkable by anyone with a Cloudflare account, which is a different standard of evidence than most infrastructure launch claims offer.

From a web infrastructure standpoint, the security framing is worth taking seriously too. Cloudflare’s isolation-by-default design — every page treated as untrusted, every session disposable — is a sound instinct given how much attention prompt injection and AI agent security have drawn as agentic browsing has scaled up. An agent that can be tricked by hostile page content into leaking data or taking unintended actions is a real, demonstrated risk category, not a hypothetical one, and building the browser itself around the assumption that every page is potentially hostile is the right default rather than something bolted on afterward.

Should you actually use it?

Clayton Samuel (Mr Wangdoo), QFA

Founder & editor, Wangdoo.com. Qualified Financial Adviser with a background in electronics, web development, and cloud infrastructure.