PawWork controls a signed-in browser from its side panel

What this is about

PawWork, whose GitHub repository is named BrowserKitten, is an open Chrome extension for tasks on the currently open web page. Unlike a remote browser service, it works inside an already signed-in Chrome profile. Users select content on a page, describe an outcome, and let the agent operate the current tab or produce an editable document.

The project is not available in the Chrome Web Store. It is installed as an unpacked Manifest V3 extension, requires Chrome 135 or newer, and asks users to provide a key for an OpenAI-compatible endpoint. The project therefore supplies neither a hosted model nor a managed cloud service.

What PawWork actually does

The extension opens an agent in Chrome’s side panel. According to the project documentation, the agent can control the current tab through an action interface. A second runtime can execute JavaScript in the browser context. Working artifacts such as sheets, documents, or HTML remain available within the session.

Its architecture divides work among the side panel, a service worker, and an offscreen session service. The model does not run locally: users enter their own API key, which is stored in chrome.storage.local. Chrome 138 and newer also require permission for User Scripts for certain functions. Restricted pages such as chrome:// and the Chrome Web Store remain unavailable.

Why it matters

Many browser agents start in a fresh cloud session. That creates friction when a task depends on an existing login, a shopping cart, or an internal web application. PawWork instead uses the active session. For recurring research, transferring web data into a document, or working in internal portals, this can remove several manual handoffs.

The approach is also more inspectable than a closed service: the source is available under the MIT license, release packages are published, and the repository includes runtime and browser-integration tests. This does not make every action safe. OWASP identifies prompt injection as a central risk for applications built with language models. A web page can contain text designed to push an agent toward unwanted actions.

In plain language

PawWork is like an assistant who does not sit at an empty spare computer, but works beside you at your already open desk. The assistant sees the same papers and can open the same drawers. That saves trips, but requires firm boundaries: sensitive drawers should stay closed, and important actions need supervision.

A practical example

A procurement team reviews 30 supplier profiles in an internal portal. An employee selects the relevant parts of each page and asks PawWork to transfer the supplier name, delivery time, and certificates into a sheet. Two profiles lack information; the agent flags those rows for manual review instead of inventing values.

The team first tests the workflow with five non-sensitive profiles. Write operations, purchases, and messages remain disabled. Only after the outputs look correct does the team extend the process to the remaining 25 profiles. The sheet remains a working draft and is reviewed by a person before distribution.

Scope and limits

First, a browser extension with page access occupies a sensitive position. A compromised API provider, manipulated web page, or agent error can expose data or trigger incorrect clicks. Separate browser profiles and minimal permissions are sensible safeguards.

Second, installation is technical. The extension must be loaded manually and reloaded after changes, and some functions require Chrome settings. It suits technically capable users better than teams expecting centralized administration and support.

Third, PawWork does not replace approval processes. Payments, publication, deletion, and production-system changes should not run autonomously. A successfully completed browser workflow also does not prove that captured content is factually correct or complete.

SEO & GEO keywords

PawWork, BrowserKitten, browser agent, Chrome extension, browser automation, local session, BYOK, open-source AI, Manifest V3, prompt injection