Claude browser use agents for portals with no API: decide first, then guard

Ask an operations lead where the week goes and the answer is rarely their own systems. It is the supplier portal that wants every invoice typed in by hand. It is the carrier's tracking site, or the customer's procurement portal with a login, a one-time code and no API. Someone copies data out of one window and types it into another, hundreds of times a month.

Browser agents have been able to do this work for a while. What changed in October 2026 is the price and the tooling. The model is no longer the hard part. The hard part is deciding whether a browser agent is the right tool, and setting up guardrails before it touches a live account. This post covers both.

Most growing firms have connected their core systems reasonably well. The accounting package talks to the bank feed. The store talks to the warehouse. The gaps sit at the edges, on portals run by other organisations: a large buyer's vendor portal, a logistics partner's exception queue, a regulator's filing site, an old internal tool nobody wants to touch.

These portals share three traits. They have no public API, or one you can't get access to. They change layout without warning. And they hold work that matters, such as purchase orders, delivery disputes and payment status, so mistakes cost money.

The usual answer has been a person, or a brittle script that breaks every time a button moves. A browser agent sits between the two. It reads the page the way a person does and decides what to click next, so it copes with small layout changes that would break a script.

On 7 October 2026 Anthropic released Claude Haiku 5.5 (opens in a new tab), its fastest model so far and the first Haiku with an adjustable effort setting. The model ID is claude-haiku-5-5, and it is available on the Claude Platform, AWS, Google Cloud and Microsoft Azure. Anthropic's announcements page (opens in a new tab) lists it after the Sonnet 5.5 and Opus 5.5 releases, which completes the 5.5 family.

Anthropic describes Haiku 5.5 as built for high-volume, cost-sensitive tasks and suited to speed-sensitive work such as browser use. Two figures from the launch post (opens in a new tab) stand out:

• Cost: around 75% cheaper to run than Haiku 4.5 on average.
• Computer use: on the OSWorld 2.1 offline subset, Haiku 5.5 scores 72.4%, against 15.7% for Haiku 4.5 and 83.9% for Sonnet 5.5.

In the same release, the Claude Python and TypeScript SDKs gained beta support for browser use and computer use. According to the SDK toolset documentation (opens in a new tab), the toolsets are available on the Messages API and on Claude Models on Google Cloud (Google managed), but not in Managed Agents. The SDK runs the agent loop and the checks you configure. You supply the browser driver, either from a provider such as Browser Use, Browserbase, Daytona or E2B, or written yourself with a library like Playwright.

So a cheap, capable model and a supported loop are now available off the shelf. What you still have to decide is whether to use them at all.

A browser agent should never be the first thing you reach for. Work down this ladder and stop at the first rung that fits.

1. Official API. If the portal has an API, even a limited or paid one, use it. APIs are faster, cheaper per transaction, easier to audit and far harder to trick. Ask the portal owner directly. Many firms find an API they didn't know about.
2. Integration or MCP. Look for an existing connector, an export or import feature, an EDI or SFTP feed, scheduled email reports, or an MCP server that exposes the system to an agent in a structured way. A nightly CSV you can parse is better than a browser session. This is why we push for integrations and APIs first.
3. Browser agent. When there is truly no programmatic route and the task repeats often enough to justify setup, a browser agent earns its place. It works best when the steps are clear, the inputs are structured and a wrong action can be caught before it lands.
4. Human. Some steps should stay with a person: one-off tasks, steps that need a relationship or negotiation, and anything where an error would be costly and hard to reverse. The agent can still prepare the work, filling a form up to the final button and handing over.

In practice most workflows mix rungs. An invoice might arrive by API, get checked by an agent, be keyed into a supplier portal by a browser agent, and be approved by a person.

Not every step needs the same model. Anthropic says Haiku 5.5 suits narrowly scoped tasks and works as a subagent alongside Opus 5.5 and Sonnet 5.5, while Sonnet and Opus 5.5 remain the better choices (opens in a new tab) for complex agentic coding.

A sensible split looks like this:

• Haiku 5.5 for navigation. Logging in, finding the right record, paging through lists, filling known fields, reading a status. These steps are high volume and low judgement. Use the effort setting to keep simple steps fast and turn it up for harder pages.
• Sonnet 5.5 or Opus 5.5 for judgement. Deciding whether a mismatch between a PO and an invoice is acceptable, reading an unusual exception, planning a multi-step task. Fewer calls, more thinking per call.

The 11-point OSWorld gap between Haiku 5.5 and Sonnet 5.5 is a reminder that the cheaper model will fail more often on open-ended tasks. Keep its tasks narrow and let a stronger model, or a person, handle the cases it isn't sure about.

Anthropic's SDK documentation (opens in a new tab) lists six steps to take before you move beyond a throwaway browser. Treat them as the minimum.

1. URL policy. Define which domains the agent may visit. Without one, the SDK checks no URL at all, and it doesn't check schemes such as javascript:, file: and data:. Allow-list the portal and nothing else.
2. Request interception. Inspect and block requests the browser makes, not just the pages the agent asks for.
3. Egress policy on the container. Control network traffic at the container level. The documentation says egress rules should block private address ranges and the cloud metadata address 169.254.169.254, so a hijacked session can't reach your internal network or cloud credentials.
4. Limits on uploads and downloads. Decide which files the agent may upload and what it may download, and cap both.
5. Confirm gates on consequential actions. Pause for approval before actions with real effects.
6. An isolated container or VM for each session. No shared state between runs, nothing left behind afterwards.

Two more points from the same page matter. Page content is untrusted: any text the agent reads could be an instruction planted to redirect it. And Anthropic's prompt-injection classifiers don't currently run on browser toolset requests sent through Amazon Bedrock, so if you deploy there, your own controls carry more of the load.

Confirm gates are the step teams most often get wrong. The documentation (opens in a new tab) is blunt: purchases, sent messages and accepted terms all happen through ordinary clicks and typing, so confirm can't identify them by name. There is no 'buy' action to block. There is only a click on a button that happens to say Submit.

That means you have to define the risky moments yourself, for each portal:

• Any final submit on a form that creates an order, a payment, a dispute or a filing.
• Any message sent to an outside party.
• Any checkbox that accepts terms.
• Any change to bank details, addresses or user permissions.

The documentation also says the browser profile must not be signed in to any account you wouldn't hand to Claude. In practice, create a dedicated portal user with the narrowest role the portal allows. Never reuse an admin login.

For audit, keep a record of each session: the URLs visited, the actions taken, screenshots at each gate, and who approved what. When a supplier disputes an entry three months later, you want to replay what happened.

Here is an illustrative sum. The assumptions are ours, not Anthropic's. Say one portal task takes 20 steps, each step sends about 8,000 input tokens and returns about 300 output tokens. That is roughly 160,000 input and 6,000 output tokens per task.

At Haiku 5.5's published prices (opens in a new tab) for prompts up to 100k tokens ($0.10 input, $0.50 output per million), that comes to about $0.02 per task. At 5,000 tasks a month, around $95.

The same task on Sonnet 5.5 ($2 input, $10 output per million) is about $0.38, or roughly $1,900 a month. Anthropic has also halved Sonnet 5.5 cache reads to $0.10 per million, which it says makes most agentic work about 20% cheaper.

Two practical lessons. First, keep each prompt under 100k tokens: Haiku 5.5 input rises from $0.10 to $0.50 per million above that, so trim history and screenshots. Second, cache what repeats, such as system prompts and portal instructions. Haiku cache reads are $0.01 per million. At these prices model spend is rarely the biggest cost. Setup, monitoring and human review are.

The best candidates are repetitive, structured and currently done by hand:

• Invoices. Pulling supplier invoices from portals and posting them to accounts. See our invoice-to-Tally automation.
• RFQs and POs. Collecting requests from buyer portals and keying acknowledgements back. See RFQ and PO automation.
• Shipment exceptions. Checking carrier sites for delays and logging them. See the shipment exception desk.
• Legacy systems. An agent can bridge an old internal tool while you plan its replacement. See legacy system modernisation.

Before the agent touches a live account, check each line:

• We confirmed there is no API, export or connector for this portal.
• The task repeats often enough to justify setup and monitoring.
• A URL allow-list is set, and javascript:, file: and data: schemes are blocked.
• Request interception and container egress rules are on, including private ranges and 169.254.169.254.
• Upload and download limits are set.
• Each session runs in its own isolated container or VM.
• The portal login is a dedicated, least-privilege account.
• Every submit, send, accept or payment step has a human gate.
• Page content is treated as untrusted, and Bedrock deployments have extra controls.
• Sessions are logged with URLs, actions, screenshots and approvals.
• Haiku handles navigation, and a stronger model or a person handles judgement.

Softpiper is a Claude Partner Network · Select Services Partner, and we design AI agents and automation that start with integration and use browser agents only where nothing else fits. After launch, our management, support and modernisation work keeps them running as portals change. If your team spends hours a week re-keying data into a portal, talk to Softpiper about a portal workflow.

• Introducing Claude Haiku 5.5 (Anthropic, 7 October 2026) (opens in a new tab)
• Browser and computer use with the SDK toolsets (Claude Platform Docs) (opens in a new tab)
• Announcements (Anthropic newsroom) (opens in a new tab)