agent-browser 0.39.2, tested: it stopped telling your agent that dead clicks worked

agent-browser is the command-line tool Vercel Labs built so AI coding agents can use a real browser. The agent opens a page, gets back a short list of the page's buttons and fields with reference numbers like @e2, and then clicks or types by number. It is a native Rust program installed from npm, it works with Claude Code, Codex, Cursor and any agent that can run shell commands, and it has more than 44,000 GitHub stars. It was on GitHub's daily Rust trending list this morning.

Version 0.39.2 came out on October 22 with ten bug fixes. Three of them are about the tool telling the agent the truth. The project's own pull request puts the first one plainly: "click reported ✓ Done on hidden, off-screen, and disabled elements, but the event landed on <html> or nowhere." An agent that trusts that message moves on as if it had placed the order or pressed confirm.

The test. We installed 0.39.2 and the previous release, 0.39.1, side by side from npm on a Linux box and pointed both at the same Chrome 156. We wrote small local test pages that record every real click, and ran the same commands through both versions. No AI model, no API key, no cloud browser.

Dead clicks. Our page had a disabled button, a button with display: none, one with visibility: hidden, and one placed 600 pixels left of the page where no scrolling can reach it. 0.39.1 answered "✓ Done" for all four. The page recorded zero clicks. Asking the same thing the way an agent would, by reference number with --json, 0.39.1 returned "success": true for the disabled button. 0.39.2 refused all four with a reason an agent can act on: "Element '#disabled' is disabled, so the click would not reach it", "is not visible", "is outside the viewport". It didn't over-correct: a normal button and one far to the right on a scrollable page were scrolled to and clicked on both versions. A button hidden under a page-wide overlay was already caught by 0.39.1. The failed checks came back in 4 to 6 milliseconds.

Blocked redirects. agent-browser can limit an agent to a list of allowed domains. We allowed 127.0.0.1 and opened a page there that redirects to localhost. 0.39.1 printed a check mark and the blocked address and exited 0, as if the page had loaded. 0.39.2 exited 1 with "Navigation to http://localhost:8765/redirect.html (opens in a new tab) was blocked by the domain filter." On both versions the blocked server never got the request, so the filter itself worked; the old version just didn't say so. One leftover: after the error, get url on 0.39.2 still prints the blocked address. Trust the exit code.

Broken policy files. You can give agent-browser a policy file that forbids actions such as running JavaScript. We gave both versions a policy meant to deny eval, with a missing bracket. 0.39.1 ignored it and ran eval 1+1, printing 2. 0.39.2 refused every command and named the file and the JSON error. A policy with "deny by default" and an empty allow list let 0.39.1 run eval; 0.39.2 denied it.

The catch. The docs' own "restrictive" example policy, which denies by default and allows navigate, snapshot, click, scroll, wait and get, blocked every command on both versions, including opening the page: "Action 'launch' is not in the allow list". close --all was blocked too, so the background process kept running until we killed it. Adding "launch" and "close" to the allow list fixed it on both versions. Neither action appears in the docs' category table as of this morning.

What we did not test. The AI chat mode (it needs an AI Gateway key), cloud browser providers, the Obscura and Lightpanda engines, iOS, the login vault, MCP server mode, the other seven fixes in the release, agent-browser install (we used the system Chrome), real websites, Windows and macOS.

The verdict. Upgrade if an agent drives a browser for you. 0.39.2 turns three silent failures into errors your agent can see and retry. If you lock it down with an action policy, allow launch and close or nothing will run.

Disclosure: not sponsored. No affiliate links. MODEL has no relationship with Vercel. Full test notes, commands and outputs are kept by MODEL Editors.