AI agents … when capability outruns reliability

Decodo released the Agentic Capability Report, which examined 45 AI-powered browsing tools against ten capabilities, from model prompting and transaction completion to multi-step task execution, tab awareness, memory, site-wide execution, pre-action confirmation for irreversible actions, background tasks, and third-party integrations.

According to Decodo’s evaluation, Claude for Chrome and Amazon Nova Act achieved the highest overall score, 18 out of a possible 20. They were followed by Fellou and ChatGPT Desktop with 17 points, noting that Fellou’s score included a two-point deduction after practical tests. Skyvern scored 16 points, Vercel Agent Browser 15 points, and no product achieved a perfect score.

The gap between documentation and actual performance

The report’s most important insight is not the product ranking but the distinction it draws between documented capability and practical performance. The researchers first examined how clearly each provider described its capabilities in public documentation, pricing pages, and changelogs, awarding up to two points per capability for a maximum documentation score of 20. They then subjected high-risk claims to practical tests, recording failures, freezes, timeouts, session drops, and incomplete task execution.

This means the results are not read as a laboratory comparison in which every function of all 45 products was tested under identical conditions. The headline scores reflect documented functions, with adjustments where practical tests revealed inconsistencies or issues in credibility or reliability. For example, Fellou initially received 19 documentation points, but practical tests encountered difficulties with complex layouts, loops, and CAPTCHA codes, lowering its multi-step task score and overall total to 17.

Transactions… the most dangerous agent capabilities

The “transactions” category recorded the lowest average capability in Decodo’s research, at only 0.43 out of 2 points. The category means completing a purchase or checkout, not merely adding a product to a cart. Only six products earned the full mark for transactional actions: Amazon Nova Act, BrowserOS, ChatGPT Desktop, Minded, Sigma Browser, and Skyvern.

The result highlights a fundamental difference between an “AI assistant” and an “independent agent”. Finding products and presenting options leaves the final decision to the human. Completing a purchase turns an AI-generated decision into an external action involving money, making guarantees critically important. Decodo notes that ten tools document a stop point before an irreversible action, yet the published report lists only nine products in the accompanying paragraph, a discrepancy that makes the claimed total cautious unless clarified by the researchers.

Crucially, only two products, Amazon Nova Act and ChatGPT Desktop, document both the ability to complete a purchase and a mechanism to pause and obtain confirmation before executing an irreversible action. This distinction has implications for institutions evaluating independent agents: appropriate capability and autonomy are not necessarily the same thing. The level of autonomy granted to an agent should reflect the potential consequences of a mistaken decision.

Multi-step workflow… where stop points are missing

The tension between autonomy and oversight becomes clearer with multi-stage workflows. Of the 35 tools Decodo says document full multi-step task completion, 18 tools (51 %) lack a documented confirmation step before an irreversible action. This matters because one of the most appealing aspects of agentic AI is its ability to chain activities toward a goal without a person issuing new instructions at each stage. Removing those interruptions also removes opportunities for human supervision.

Background activity raises concerns. Decodo’s evaluation found 17 products that document the ability to operate without an active user session. Seven of them, Airtop, Axiom AI, BrowserOS, Browserbase, HARPA AI, OpenHands, and Opera Neon, were rated as combining background operation with no documented confirmation step before irreversible actions. This does not prove that these products will actually execute harmful actions on their own, but it identifies, as Decodo assessed, the type of checkpoint the study examined where supplier documentation is silent.

Tab awareness… the advantage of native extensions

Another relative weakness is tab-aware awareness, which averaged 0.66 out of 2 points. Tools that earned the full mark were often native browser extensions, including Claude for Chrome, ChatGPT Chrome Extension, Chrome Gemini, Sigma Browser, Opera Aria, Opera Neon, and Brave Leo. Decodo points out that independent automation platforms and cloud-based browser infrastructure scored lower in this category. Cross-tab operations matter because real digital work often compares information or maintains context while navigating between sources, so strong performance within a single page does not necessarily translate to effective handling of more complex browsing workflows.

Security… greater independence means greater responsibility

Decodo cites industry security research on prompt-injection attacks against browser agents. These attacks involve malicious or untrusted content attempting to influence the agent’s behavior while it performs another task. The report references research tied to Anthropic, OpenAI, and Brave discussing this issue. The risk grows the more agents are granted permission to access private information or execute actions outside the AI model itself. This does not mean that independent browsers are inherently insecure, but it underscores the importance of permissions, confirmation mechanisms, and human oversight when agents interact with sensitive data or consequential workflows.

Reading the report cautiously

The Decodo results should be interpreted with an important qualification: this is vendor-produced research, not an independent academic standard, and its evaluation model heavily weights what suppliers publicly document. The practical component adds evidence of real-world behavior, but it should not be taken as proof of how any product will perform under every circumstance. Nevertheless, the research shines a light on a useful problem for organizations adopting agentic AI: the most advanced agents are not necessarily the best fit for a particular workflow.

Gabriele Vitke, product marketing lead at Decodo, says companies should focus on fit rather than the breadth of advertised capabilities: “Someone on your team will remain responsible for what happens when the agent makes a mistake,” she concludes, “Match the tool to the role, not to the longest feature list.”

What this means for readers in the region

Enterprises in the Gulf, Egypt, and the Levant that are testing independent agents for automating purchasing, compliance, or customer-service processes face the same dilemma: the tool that tops the feature list may lack a guarantee of confirmation before an irreversible action. Granting autonomy to an agent should be based on the specific risk profile of each process, not on a generic benchmark score. The practical takeaway: start with low-consequence workflows, request explicit documentation of pause and confirmation mechanisms, and treat feature lists as starting points for vendor dialogue rather than purchase decisions.