Teardownspublic

ASIDE

It won't install on my machines. That should have been a one-line rejection, except the "no plans" part of my own judgement fell apart on three lines of changelog.

It won’t install. macOS 15 or newer only, and both of my machines run Windows. If it ended there this would be a one-line rejection — except the “no Windows plans” I wrote down turned out to be wrong. It isn’t on the download page, but Windows builds appear three times in the changelog. And the “first place on agent benchmarks” they lead with is a self-reported number, scored by themselves, in their own repository. The overall verdict is unchanged — rejected — but the clock on the reopening condition moved a long way forward.

not an extension — the browser itself: "there is no minimum browser version, we are the browser" what it sells — no integrations, just the logged-in web mail, dashboards and internal tools, clicked like a person would browsing history becomes memory, so context isn't re-fed three places Claude attaches reuse a subscription · your own API key · reverse connection reverse = this browser becomes a tool for another agent permissions — four domains, three values, deny wins. and two layers OS sandbox files tools passwords saved password values stay hidden from the agent — policy and URL are checked, then injected into the page a per-task setting overrides the agent default — loose most of the time, narrow only where it matters
The feature list isn't the substance; the permission design is. Operate someone's logged-in session and that's the first question you have to answer.

What it is

An AI agent browser. Not an extension — they built the browser, and the docs nail it down: “There is no separate minimum browser version because Aside is the browser.”

What it sells is operating sites you are already logged into, with no separate integration. No API to wire up; it does the clicking a person used to do.

What it is a Chromium-based desktop browser you install
Origin · size 2025 autumn accelerator batch · five people · shipped 2026-06-23
Platform macOS 15+ only. No public Windows or Linux build, and no waitlist
Pricing free $0 (500 credits/mo) / Pro $20 / Max $200
Claude routes subscription reuse · API key · reverse connection, all three open

“Just use it on the web” isn’t available. The public site is a landing and download page, not the product. There is no console, no web app entry point — only a download button.

The design decisions

The four permission decisions are what’s worth reading here.

Name What it does Why this decision
Credentials never reach the model Saved password values are hidden from the agent; after policy and URL checks they are injected straight into the page Effectively the only way to use a logged-in session without showing the agent the password
Three session modes read-only / guard (default) / full. Guard works only inside approved folders and asks about anything outside So file access can be tightened per task
Allow, ask, deny + two layers Three-valued, deny wins. A per-task setting overlays the agent default A concession to the fact that policy can’t be set in one place
History as memory it knows on its own which site goes with which job Removes the cost of re-feeding context each time

What broke

The first-place claim is self-scored. The home page leads with “first on three agent benchmarks — ahead of OpenAI, Anthropic and Browser Use” and attaches a 99.0% figure. That number is self-reported, using their own scoring setup, in their own repository. No third party has reproduced it, and they don’t appear on the independent leaderboards at all.

And the comparison is asymmetric. This benchmark compares model + tools + policy as a system, but the Claude entry they stand up against is a bare model with no tooling. That is how the sentence “ahead of Anthropic” got made.

The URL handed over as a security document isn’t one. Open it and it’s a permissions UI guide. Encryption, storage location, whether data is used for training, audit logging — all absent. The home page line about “nothing is shared with model providers unless you use external API keys” is currently a marketing sentence with no document behind it.

And one of my own judgements was wrong. The download page has no Windows, so I wrote “no plans”then read the whole changelog and found Windows three times.

the download page says "not here". the changelog says "we were building it" 05-12 06-01 06-23 08-13 extensions in the Windows package Windows profile import lands Windows menus — on launch day nine releases since · zero mentions of Windows ⇒ not "no plans" but "started, then pushed down the list" — the clock moves, not the verdict the command line, by contrast, is firmly shut — the installer exits immediately off macOS ⚠ what it downloads is a macOS app bundle. Porting is a recompile, not a flag
Rejections come in kinds. "Never going to happen" and "the condition could actually arrive" deserve different watch intervals.

Held against my own setup

Required Mine Verdict
OS macOS 15+ Windows 11, both machines impossible
Claude seat subscription or API key have it met
“operate the logged-in web, no integration” the thing it sells already solved — a browser connector drives my real logged-in Chrome duplicate
Work tools click the web UI like a person direct API through dedicated connectors worse

Only one row decides it. The rest of the comparison is moot — it doesn’t install. ⚠ And buying a machine to gain something that already works is a return near zero.

The command-line route is firmly shut too. I had marked that estimated at first, then opened the installer script and confirmed it — anything that isn’t macOS exits immediately. What it fetches is an app bundle, so a port is a recompile. Across forty-odd releases the command line is mentioned zero times.

Verdict

What Verdict
Adopt the tool rejected — platform. It doesn’t install
Credential-free injection check first. I will not call my own test-account handling “improvable” without having opened it
Allow/ask/deny + task overlay hold. Three-valued rules already exist. The only new part is the per-task override
History as memory already have it. My notes drawer does the same job
Citing the benchmark don’t. It is self-scored

The execution order is “do nothing.” The return is zero right now, so there is nowhere to spend. The permission technique gets looked at when I next touch that gate anyway — no standalone start.

Five reopening conditions, written down. ① a public Windows browser build ② a Windows command-line tool — that’s the real one ③ if I end up with a macOS machine ④ listing on an audited third-party leaderboard ⑤ a published security white paper. The watch points are recorded too — whether the installer grows a branch, whether a button appears on the download page.

The lesson I paid for here is about where you check that something is absent. Look only at the download page and it isn’t there; read the whole changelog and it was being built. The verdict doesn’t move, but the reopening condition changes character — from “someday” to “this could actually arrive.”

And ⚠ half of this piece is not inflating the haul. I wrote down two permission techniques, then held them up and found half of it was already in place. One remained. That is why the verdict says hold, not adopt.