unbrowseYour agent needs flight prices from a small airline's website.
Nobody has ever taught an agent that site.
I'm Lewis Tham, founder of Unbrowse and first author of "Internal APIs Are All You Need". This is how we plan to let someone else's machine do the slow part without ever seeing what you searched for. It is a design. I'll say exactly what runs today at the end.
The first call is the expensive one
Unbrowse learns the request a site's own page makes, once, in a browser. After that, agents replay it over HTTP.
The replay is cheap. The learning isn't. In our April 2026 paper's cost model, learning a route through a browser costs about $0.10–0.53 per task once you count the browser, the LLM tokens and the retries.
It's slow, too. On our own demo booking site, browsing for the answer takes a median 36.7 seconds. Replaying the learned request takes 1.97.
And plenty of sites aren't learned yet. In our September eval, 42 of 100 sites replayed a new query without a browser. The other 58 are where an agent stalls.
When a route is missing, today the agent browses the site in Unbrowse's cloud browser. That works when the site lets a datacenter browser in and you have half a minute to spare. I wrote up why that first call matters in The First Call Is the Expensive One.
Often the site doesn't let it in. Meanwhile someone else's machine could be sitting idle with a real browser and a home connection.
The obvious way to delegate leaks everything
The obvious move is to send that machine the task.
"Search flights from Singapore to Tokyo on 14 November for two adults, cheapest first."
Now a stranger knows where I'm going, when, and with whom. They're also holding the result I'm about to book from, so they get to decide what "cheapest" means.
I've handed my trip to someone whose only qualification is being online.
Delegate the learning, not the task
The rule: a job carries the site, the intent and dummy inputs. Nothing else.
JOB (goes to a stranger's node)
site: flights.example-air.com
intent: learn flight search
inputs: LHR -> JFK, 1 adult, any date next month (dummy)
returns: recipe: endpoint, parameters, response shape
LATER (runs on the requester's side only)
call: search(origin=SIN, dest=NRT,
date=2026-11-14, adults=2)
The node learns how the site's search works using a made-up trip. It hands back a recipe: which endpoint, which parameters, what comes back.
Then the requester runs the real search itself, with its real values, from its own side.
The stranger learns that the airline has a search endpoint. They never learn that I'm going to Tokyo.
A route is a function. You can teach someone the function without showing them your arguments.
You hold the money, so you check the work
In the design, the requester pays the job fee into escrow. It's released when the requester's own call through the new route works.
The node saying "done" doesn't count. Neither does an HTTP 200, which is sometimes a login page saying hello. It counts when the requester's real query comes back with a real answer.
That makes the requester the validator. It's the one party that wants the route to work and holds the inputs to prove it. If the route fails or the deadline passes, the requester gets the fee back and browses the site itself.
The case we haven't settled: a requester who says "it failed" when it didn't, to keep the fee. Checking is cheap, one HTTP replay, so someone else can rerun the route with the dummy inputs. The exact dispute rule isn't decided yet.
Paying yourself gets you nothing
Any network that pays rewards invites people to pay themselves.
If a paid job also earned a bonus from some network reward pool, the play writes itself. Post a job. Pick it up with your own node. Release your own escrow. Collect the bonus. Repeat until the pool is empty and the registry is full of routes nobody asked for.
So in the design, paid jobs carry no bonus on top. The node gets the fee, and that's all.
Pay your own node and you've moved money from your left pocket to your right, and burned a browser session doing it.
To be clear about today: nothing in Unbrowse pays anyone for learning routes. There is no job market, no escrow and no reward of any kind yet.
One lease per site, so nobody hammers it
The other way delegation goes wrong is on the site's side.
Ten nodes see a job for the same small airline and all point browsers at it at once. The airline's servers would call that an attack, and they'd have a point.
So a site gets one lease at a time, across the whole network. One node holds it, learns, then finishes or times out, and only then can another node take the site.
The node checks the site's robots.txt before it takes the lease and again when it runs, and keeps to the rate limit. A route that can't be learned inside those rules doesn't get learned. That matches how our registry crawl already works: it honours robots.txt today.
Signed-in sites never leave your machine
Some routes need an account: your invoices, your bookings, your CRM.
Those are never delegated. Learning them needs a login, and a stranger's machine should never hold yours.
Signed-in routes get mapped a different way, by people using their own accounts. That's the subject of The Best Routes Are Behind a Login.
Where delegation fits
When a route is missing, the agent would work down this list:
1. private cache live routes you already learned
2. public registry live scrubbed, read-only routes
3. delegated job plan a stranger's node learns it,
dummy inputs
4. browse yourself live our cloud browser today;
your own browser is in testing
Every path ends in an indexed route, so the next agent starts at step 1 or 2 instead of step 4.
Where this actually is
As of 12 October 2026, here is what's live: learn a site's request once in a browser and replay it over HTTP. Outcomes are verified, because a 200 is not a success. The public registry of scrubbed, read-only routes, which publishes a route only after a clean replay and keeps re-checking it.
In testing: browsing through your own browser with the CLI. Separately, nodes run by other people taking index jobs are merged behind a flag and run only as a staging pilot. As of that date they are not in production.
Plan, not built: delegated learning jobs, escrow, network-wide leases, and step 3 of that list. The dispute rule is still open.
We're publishing the rules before the code, so you can break them while it's cheap.
It's one MCP server: unbrowse.ai/mcp. Setup is in the docs. If you can see a hole in this design, now is the cheapest time to point at it.
Strangers can learn the site. Only you run the search.