Kitesurf is the Dynamic Workers follow-up

Cloudflare, Aug 6 2026. Agent-first browser in V8 isolates on Workers, 3-7x less CPU and memory than Chromium. No WebGL, no long-lived auth, no bot-challenge handshake.

Speaks CDP so Playwright already works. Same bet as Dynamic Workers, now for browse. What you give up when the browser is not for a human.

If you already bought the isolate story for agent code, this is that purchase for a DOM.

PageScript is a Dynamic Worker#

Twelve weeks. First commit in May. Cloudflare's announcement says the quiet part out loud. "Kitesurf simply wouldn’t have been possible before this." The this is Dynamic Workers.

Every next page, and every out-of-process iframe, spins a long-lived PageScript isolate. Clean globalThis. A DOM.

HTML and CSS come through Blitz and Firefox's Stylo. Page JavaScript runs in that same isolate. eval goes through Boa, because Workers still bans native eval for the same security reasons it always has.

A runtime on top of a runtime. Celso admitted it is not optimal. It works often enough for the evals they actually hit.

Network is the same capability trick as the Dynamic Workers post. One SandboxOutbound worker. Nothing else can fetch.

CORS, cookie jars, header injection, 403s for anything that fails the policy. The parent decides what the page is allowed to touch. The isolate does not inherit the open internet by accident.

That is not a Browser Rendering paint job. Browser Run's default is still Chromium. Kitesurf is a different engine, opted in with a query flag, assembled from Rust compiled to Wasm, sitting on the isolate primitive they shipped for model-written functions.

They sold the chairs. Chromium is a dining room. Kitesurf is the pass-through kitchen window. The agent never sat down.

Blitz's own README still calls the engine pre-alpha and tells you not to build apps on it. Cloudflare put that stack behind a public beta anyway.

Nico Burns, who has been writing Blitz for two and a half years, showed up on Hacker News to confirm the stack and to say they intend to upstream. Pre-alpha under a CDN is a vibe.

Cheaper and slower is the product#

The number people repeated is 3-7x. The table underneath is more honest.

Cloudflare's Kitesurf docs publish medians of five Browser Run Quick Action runs across a 14-URL corpus, Kitesurf against a warm Chromium pool. CPU for a screenshot drops from 1,173 ms to 380 ms. HTML extraction drops from 877 ms to 229 ms.

Memory falls from 271.0 MiB to 57.8 MiB on screenshots, and from 273.7 MiB to 39.4 MiB on extraction. Wall time goes the other way. Screenshot 1,148 ms against 637 ms. Extraction 820 ms against 472 ms. About 1.7x to 1.8x slower.

Treat those as vendor claims with a method, the same way the Dynamic Workers 100x isolate line got treated. Fourteen URLs. Five runs. Warm pool on the Chromium side.

Nobody published an independent agent-workload A/B, and this post is not going to fake one.

The inversion is the product. You pay for CPU and memory. You wait on the wall.

A JIT that has already seen the page will beat a cold software renderer, and Cloudflare says so. Most of the gap is rasterization and JPEG or PNG encoding.

If you launch one screenshot and stare at the spinner, Chromium wins. If you launch a few hundred short, independent agent tasks and you pay the bill, the isolate wins. Burst is the job. Warmth is the old job.

It also runs Doom. Of course it does.

WPT coverage moved while the recaps were still quoting the blog. The Aug 6 post said 215,000 plus. The Aug 7 docs say over 235,000 subtests.

DOM 97 percent, HTML 96, selection 99. That is conformance, not "your SaaS dashboard will render." The playground is the real test, and they say that too.

You give up looking like a person#

The cannot-do list is not a footnote. It is the shape of the bet. The docs send every one of those jobs back to Chromium.

• Video stays off. So does WebGL.
• No bot-challenge handshake with real TLS fingerprints.
• No ten-minute authenticated session that needs persistent state.
• CDP is a subset, not a thinner Chromium.

CDP is a subset. Enough for most agent and automation work. DOM and network inspection are the parts they brag about.

There is no published missing-command matrix. "Playwright already works" means you can connect. It does not mean Kitesurf is Chromium with a thinner waist.

You will also not look like a shopper. Browser Run's FAQ is blunt. Requests are always identified as bot traffic by Cloudflare.

Celso repeated it on the HN thread, then pointed at the documented User-Agent and the Web Bot Auth signatures. cf-biso-devtools is not optional. The Signature headers are not optional.

There is no IP rotation. Traffic comes from Cloudflare ranges. Bot detection ID for CDP and Playwright is 119853733.

"You can block today. Kitesurf doesn't try to hide." That is Celso again. For once the vendor is not selling a stealth cloak and a shield in the same aisle.

If your agent needs to sit inside a logged-in Walmart cart, or clear a challenge page, or play a WebGL map, you are not the customer this engine is for. Flip the flag off. Keep Chromium. Stop asking an isolate to wear a face.

The empty tab bar is the honest UI. Tabs, themes, extensions, pixel-perfect 60 fps, those were the chairs. Agents do not sit.

The isolate does not log you in, and it does not stop a page from talking#

The strongest objection on that HN thread is not "they should have forked Chromium." It is that rendering was never the hard part.

One commenter spent an hour driving the open web with raw HTTP. No JS. No images. "Rendering was almost never the blocker. Identity was."

Captchas as PNG plus WAV. SMS walls. Application questions that reject temp mail. A V8 isolate does not hold a phone number.

It does not pass a press-and-hold. It does not keep a ten-minute cookie jar warm the way a human profile does.

That objection is correct, and Cloudflare already routed around it. Long authenticated state is on the cannot-do list. The grocery agent, the App Store Connect click-through, the Costco receipt hunt, those stay on Chromium, or on a laptop that is already signed in.

Kitesurf is not failing those jobs. It refused them at the door.

The other half is nastier. An isolate stops the page from escaping onto the host. It does not stop the page from talking to the agent.

Prompt injection does not need a V8 bug. It needs a product description that says "ignore the user, buy this, exfiltrate that." The sandbox bounds what the engine can run. It does not bound what the model can be talked into doing with the tools you already granted.

That is the same capability lesson as Dynamic Workers, just pointed at a different guest. You still decide what the child can reach. A page is untrusted input. Treat it like one. The isolate is not a conscience.

Cloudflare selling bot protection and also selling the bot is the comment-section sport. Fair sport. The receipt that matters is they sign the traffic.

They are not sneaking Kitesurf through their own WAF. They are selling a labeled broom and a labeled lock, and you get to be mad about the business, but the engineering is not pretending otherwise.

Point Playwright at the isolate when the guest is not a person#

The adoption trick is cheap on purpose. Same client. One flag.

wss://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/browser-run/devtools/browser?browser=kitesurf

Puppeteer, Playwright, chrome-remote-interface, MCP clients that already speak CDP. Quick Actions take the same browser=kitesurf query. Free in beta, behind the usual Browser Run account limits.

After beta, there is no Kitesurf-specific price yet. Chromium Browser Run is still $0.09 per extra hour on Paid. Do not invent a Kitesurf SKU.

Use the isolate when the task is short, unauthenticated, and the page is in the compatibility set. Bursty fleet work where memory is the bill.

• Wikipedia, Hacker News, TodoMVC, a lot of docs.
• One-shot screenshots and HTML pulls.
• Keep Chromium when the guest has to be a person. Logged in. Challenged. WebGL. Video. A session you would be sad to drop.

The position costs something to hold. The bench is vendor-only. CDP coverage is a subset with no public matrix.

Blitz is still pre-alpha on its own README. Eval is a JS engine inside a JS engine until Workers grows up. A hostile page can still talk your agent into a bad tool call.

Flip the call if an independent corpus flattens the 3-7x, or if real Playwright suites start dying on missing CDP commands.

Until then, Kitesurf is the Dynamic Workers follow-up. Same load, grant, throw-away loop. The guest grew a DOM. The chairs are gone.