Microsoft Edge’s Eight-Year Warning for Browser Agents

In August 2026, The Verge reported that Microsoft had begun withdrawing Manifest V2 from Edge, while enterprise support runs through early 2027. Public dispute over Google’s Manifest V3 design began in 2019, putting the path from dispute to Edge’s enterprise deadline at roughly eight years. The software at issue came in identifiable packages with declared permissions; Microsoft is now also building agents that can choose and execute browser actions.

Copilot Studio’s computer-use tool can automatically use websites and desktop applications. The cited record does not establish that it operates inside authenticated sessions. No cited source measures browser-agent deployment, the likely delay in governing it, or a documented enterprise-control failure. The eight-year comparison is therefore a warning about migration friction, not a forecast that agent controls will take as long.

Builders choose browser action for the same practical reason: the web already contains the interfaces and workflows that agents need. Their convergence puts pressure on security models designed for software whose permissions can be reviewed before installation.

A manifest can name code, not intent

A conventional browser extension gives the browser a stable object to govern. A developer packages code, declares capabilities, and asks a user or administrator for permission to install it. The browser can inspect the package, constrain its APIs, and revoke it later. The approval may be broad, but the approved thing remains identifiable.

On every turn, a stateful agent changes what the browser must review. It observes a page, retains context, selects a tool, performs an action, reads the resulting state, and repeats. The browser may identify the executable that initiated the loop, but that fact does not explain why the agent chose a link, whether a page altered its objective, or whether the person intended the final transaction.

Builders reached that architecture before browser policy did. Browser Use converted website elements into a text-like representation for agents and raised a $17 million seed round around the open-source tool. Google’s Project Mariner prototype controlled Chrome, moved the cursor, clicked buttons, and filled forms. Microsoft added computer use to Copilot Studio, including dynamic detection of interface changes. Amazon released Nova Act and an SDK for agents that could independently complete simple browser actions.

Google called Mariner a research prototype, and Amazon limited Nova Act’s independent actions to simple tasks. Browser automation need not achieve reliable autonomy to create an authorization problem; an unreliable agent only has to submit one consequential form.

When agents read and write, they spend different kinds of authority. An agent that summarizes a tab can be wrong without changing the world. An agent that sends a message, confirms a purchase, changes an account setting, or uploads a file can create an obligation that survives the session. An administrator can approve the package, but cannot encode which purpose, destination, and consequence justify each later action.

Enterprise dependencies stretched a package-policy change

Browser vendors have spent years moving conventional extensions from Manifest V2 to Manifest V3. Mozilla said in 2019 that Firefox would not follow Google’s implementation where it hindered ad blockers. Microsoft gave managed organizations until early 2027 to preserve approved workflows. Mozilla protected expected browser behavior, while Microsoft accommodated businesses already dependent on installed software.

Browser vendors added origin boundaries, navigation restrictions, scheme controls, and content rules in response to earlier failures. A browser agent can cross the same boundaries through ordinary user-facing controls: click the link, open the page, fill the field, press submit. The browser sees permitted navigation while the employer may see an agent exceeding delegated authority.

Before enabling agents in managed profiles, security teams should test runtime policy and audit controls against the workflows employees already use. Once those workflows depend on an agent, changing the control model becomes a migration project.

Microsoft occupies both sides of the trust seam

Microsoft is retiring the browser’s older extension model while helping construct the distribution system for agent capabilities. OpenAI’s Agent Plugins standard packages skills and MCP servers, and Microsoft sits on its steering committee with Amazon, Cursor, and Vercel. The standard gives developers a portable way to bundle capabilities that agents can invoke without rediscovering every workflow through a screen.

In Edge, Copilot Mode has experimented with anticipating links that a user may want to click. Edge later let Copilot gather information from open tabs and use browsing history to produce more relevant answers. Copilot Studio adds action execution, while Agent Plugins adds capability distribution. Microsoft now spans context collection, execution, and distribution, although the cited Copilot Studio record does not establish use within authenticated sessions.

Enterprise customers ask Microsoft for compatibility, central administration, and gradual migrations. Microsoft’s agent products become more useful as they receive more context and perform more actions. Edge must preserve existing workflows while the company expands the decisions its software can make around them.

The control plane must bind actions to principals

Administrators must bind an agent identity to a human or organizational principal, specify the sessions and tools it may use, and withdraw that delegation without disabling the employee’s entire browser profile.

Cloudflare, Google, Microsoft, and Mozilla are working on PACT, a protocol for distinguishing legitimate human or bot traffic from unwanted requests. PACT addresses who or what generated traffic at the network boundary. It does not decide whether a legitimate agent was authorized to approve an expense, disclose a document, or continue after a page introduced new instructions.

Enterprise-browser companies including Island and Here have moved another part of the problem into the browser by building security controls and work-application integrations. Google has described a User Alignment Critic that vets each Chrome agent action. These systems put policy closer to the action loop, where the browser can evaluate identity, context, and consequence together.

A security team deploying a browser agent inherits the broader agent-execution governance problem inside a signed-in session. It needs deployment accountability at four points:

A procurement team can turn these controls into acceptance tests. In an expense workflow, for example, an agent might read approved invoice tabs, call a vendor-lookup tool, and draft a payment. A named employee should see the payee, amount, and destination before submission, while the browser retains the approval receipt. A vendor that cannot scope, pause, log, and revoke that sequence is not ready for the workflow.

An untrusted page can enter the control flow

Browsers separate sites, frames, schemes, and privileged resources. An agent can preserve those technical boundaries and still create a new security path by feeding rendered page content into its next decision.

Indirect prompt injection exploits that path. A website, message, or document can contain instructions that the agent interprets alongside the user’s objective. Brave researchers reported systemic indirect prompt-injection weaknesses across agentic browsers, including Perplexity Comet and Fellou. The agent’s ability to read the web becomes a channel through which the web can influence it.

The older extension ecosystem offers a second warning. One researcher traced a paid scraping service to extensions that overrode browser protections.

The 245-extension case shows that browser vendors can miss misuse even when code arrives as a stable package. Stateful agents add changing goals and untrusted instructions to that enforcement problem.

Neither record establishes a failure rate for browser agents, and neither implicates Microsoft’s products. The cases instead define two paths that enterprise testing must cover: approved software can misuse authority, and hostile content can redirect approved software.

Explicit interfaces narrow browser-agent authority

Software providers can expose constrained API actions instead of asking an agent to infer meaning from pixels, text, and layout.

Agent builders use screen-level automation because any website built for people is immediately available. Text representations, interface-change detection, and screenshot-based control turn the existing interface into a general adapter.

An agent navigating screens can break when a button moves, interpret instructions as data, or receive more authority from a signed-in session than the task requires. It must infer the user’s narrow request from a broad credential context.

Providers can route repeatable workflows through interfaces with inspectable actions, constrained credentials, and structured results. Browser control can cover sites and tasks that lack those interfaces. Plugins and APIs handle known capabilities, while browser operation preserves compatibility with work that has not been packaged as a tool.

Portability determines who holds the kill switch

Google and Microsoft combine browser distribution with agent research and administrative controls. Browser Use and other tool suppliers can sit above multiple browsers, while browser vendors govern the signed-in session below them.

A security team comparing browser-agent systems should ask whether it can export agent identities, domain allowlists, action logs, and approval receipts. It should also test whether it can revoke one agent without disabling the employee’s profile and whether browser policy applies to third-party skills.

The browser vendor that controls the session can decide which context an agent sees, which tools it may call, which identity it presents, and where an action pauses. If policies and delegation records cannot move with the customer, the vendor also controls the cost of leaving.

By early 2027, Microsoft’s enterprise exception will close a Manifest V2 dispute that began in 2019. That eight-year span does not predict an eight-year agent-policy delay; it identifies the cost of waiting until workflows depend on a control model. An enterprise that grants signed-in browser access before it can export policies, delegated identities, and approval records may discover that changing vendors requires rebuilding the chain of authority around every automated workflow.