Cloud browsers for AI agents 2026: Browserbase vs Steel vs Kernel vs Hyperbrowser

Summary. Kernel has the lowest published rate for plain browser time in October 2026: $0.0000166667 a second for a headless browser, about $0.06 an hour at 1 GB, with idle seconds free. Steel and Hyperbrowser charge $0.10 an hour, Browserbase $0.12 (Developer) or $0.10 (Startup) per overage hour, and Browserless, the fifth option we include, sells 30-second units worth roughly $0.18 to $0.24 per browser-hour at overage. For 20,000 three-minute sessions a month with up to 10 at once (1,000 browser-hours), list prices come to about $80 on Kernel Hobbyist, $100 on Steel Launch or Hyperbrowser, $128 on Browserbase Developer and $140 on Browserless Starter billed annually. Add 20 GB of residential proxy traffic and Kernel stays at $80, because its proxies are not billed, while the others rise to $242 to $356. Licences differ more than prices: steel-browser and Kernel's browser images are Apache-2.0, Browserbase's Stagehand is MIT, Hyperbrowser's HyperAgent is AGPL-3.0, and Browserless is SSPL-1.0 or commercial. Pick Browserbase for the broadest managed platform and compliance paperwork, Kernel for cost and long logged-in sessions, and Steel or Browserless when you must self-host.

About this article. Prices, licences, regions and compliance claims were checked against vendor pages and documentation on 22 October 2026. Vendors change pricing often, so re-check before you commit. No vendor paid for inclusion or placement. Researched with AI assistance and reviewed by our editorial team.

What changed in 2026

Agents now run thousands of logged-in browser sessions a day, so the browser bill is worth modelling. Five changes reshaped the shortlist.

• Steel repriced. Its pricing page, last edited on 30 June 2026, replaces Starter, Developer and Startup with Launch ($0 plus usage), Scale ($250 plus usage) and Enterprise; existing customers can keep their legacy plans. The change shipped in Launch Week v3, alongside a Stealth Browser for Enterprise customers.

• Steel consolidated regions. Steel announced seven cloud regions in June 2025; its session docs now say browsers run only in us-east and reject any other value.

• Browserbase became a platform. Functions, Fetch, Search and a Model Gateway shipped between February and April and were brought together as a platform on 7 April. Managed Agents followed on 30 June, Stagehand v4 on 10 August and Stagehand 4.2 on 12 October.

• Kernel moved upmarket. It passed an ISO 27001 audit in June, added Web Bot Auth support with Cloudflare in April and now offers regional browsers on its Start-Up plan.

• Browserless added agent features: a hosted MCP server in April, 1Password autologin in July, a beta /agent/run endpoint in August and BAP, a typed SDK over BrowserQL, in September.

We found no acquisition of any of the five in 2026. The latest disclosed rounds remain Browserbase's $40 million Series B in June 2025 and Kernel's $22 million seed and Series A in October 2025. One adjacent launch to watch is Cloudflare's Kitesurf, a stateless browser that runs on Workers. It is free in beta behind per-account limits, but it cannot yet hold a long-running authenticated session.

The five vendors, one by one

Browserbase

Browserbase runs each Chromium browser in a dedicated VM that is destroyed and recreated after every session. It is cloud-only, with private cloud options for large enterprise customers.

Pricing. Free gives 1 browser-hour, 3 concurrent browsers and 15-minute sessions. Developer is $20 a month for 100 hours, then $0.12 an hour, with 25 concurrent browsers and 1 GB of proxy data, then $12/GB. Startup is $99 for 500 hours, then $0.10 an hour, 100 concurrent and 5 GB, then $10/GB. Scale is custom, from 250 concurrent. Browser time is billed by the minute, with a one-minute and one-MB minimum per session, and paid sessions last up to 6 hours.

Strengths. The broadest feature set: Contexts for reusing logins, live view, replays, downloads, Playwright, Puppeteer and Selenium, an MCP server, and the MIT-licensed Stagehand SDK, which Browserbase says runs twice as fast as Playwright in v4 (a vendor benchmark). Compliance paperwork is the most complete here: SOC 2 on every plan, with a HIPAA BAA, DPA and SSO on Scale.

Limits. Included hours cost more than overage ($0.20 an hour on Developer against $0.12), so the fee mostly buys concurrency. Advanced stealth is Scale-only, and zero-data-retention mode and your own S3 bucket are Enterprise-only.

Best for: one vendor for browsers, search, fetch and hosted agents, especially in regulated sectors.

Steel

Steel's core is steel-browser, an Apache-2.0 browser API that runs from a single Docker command and accepts Puppeteer, Playwright or Selenium. Steel Cloud adds proxies, CAPTCHA solving, stealth and a Credentials API.

Pricing. Launch is $0 plus usage, with $30 of one-time credits valid for 90 days, 10 concurrent sessions and 15-minute sessions. Browser time is $0.10 an hour, proxies $10/GB and CAPTCHA solves $3 per 1,000; a $10 deposit enables proxies and solving. Scale is $250 a month with $100 of monthly credits, 100 concurrent sessions, 1-hour sessions, $0.08 an hour, $6/GB proxies and $1 per 1,000 solves. Enterprise adds 24-hour sessions and 1,000+ concurrency. Time is billed by the minute, rounded up, and a HIPAA-ready BAA is available on Scale and Enterprise.

Strengths. The only server here you can self-host free for commercial use. CDP access for Playwright and Puppeteer, Profiles and Files APIs, and a separate MIT-licensed MCP server. Steel says sessions start in under a second on average, a vendor figure.

Limits. One cloud region, short Launch sessions and a big step from $0 to $250. We found no SOC 2 claim on Steel's public pages, and its trust centre requires an access request.

Best for: starting in the cloud while keeping the option to run the same API in your own VPC.

Kernel

Kernel (kernel.sh) runs each Chromium browser in its own lightweight virtual machine. Its docs describe Unikraft-based unikernels with snapshot-based standby that keeps cookies and DOM state, and its engineering blog reports start times under 20 ms from a warm pool 99% of the time and under 550 ms otherwise. These are untested vendor claims. Browser images are Apache-2.0; the platform is cloud-hosted.

Pricing. Headless browsers cost $0.0000166667 a second (about $0.06 an hour at 1 GB) and headful browsers $0.0001333336 a second (about $0.48 an hour). Plans: Developer (free, with $5 of monthly credits and 5 concurrent browsers), Hobbyist ($30 with $10 of credits and 10 concurrent) and Start-Up ($200 with $50 of credits, 150 concurrent and regional browsers). Browsers enter standby 5 seconds after the last CDP or live-view activity and stop accruing charges. Kernel-provided proxies, from Hobbyist up, are unmetered and not billed, subject to a fair-use policy.

Strengths. Lowest metered rate, per-second billing, timeouts up to 72 hours, managed auth, Profiles, live view, browser pools and a hosted MCP server. SOC 2 is listed on every plan and a HIPAA BAA on Enterprise.

Limits. Standby browsers still hold a concurrency slot, headful costs eight times headless, and the docs warn that regions do not guarantee data residency.

Best for: cost-sensitive agents that idle between LLM calls, and long-lived logged-in sessions.

Hyperbrowser

Hyperbrowser sells one credit pool across browsers, sandboxes, web data APIs and hosted agents, at 1,000 credits to the dollar.

Pricing. Free includes 5,000 credits and 1 concurrent session. Startup is $30 a month for 30,000 credits and 25 concurrent sessions; Scale is $100 for 100,000 credits and 100 concurrent; both include CAPTCHA solving, basic stealth and residential proxies. Browser time is $0.10 an hour, proxy data $10/GB and HyperAgent or Browser Use steps $0.02 each. Bought credits expire after 12 months.

Strengths. Useful when one product mixes browsing, fetches and sandboxes. Playwright, Puppeteer and Selenium, Profiles, live view and an MCP server. HyperAgent, its agent framework, is AGPL-3.0, which matters if you modify it and offer it as a network service.

Limits. Its security page describes a programme aligned with SOC 2 criteria, and its trust centre offers a SOC 2 Type 1 report on request, not a Type II. Production data sits in US databases unless agreed otherwise, and the billing increment for browser time is not stated.

Best for: browsers, scraping and sandboxes on one bill.

Browserless

Browserless is the oldest of the five and the most flexible on deployment. Its repository is dual-licensed under SSPL-1.0 or a commercial licence; closed-source commercial use needs the latter.

Pricing. A unit is up to 30 seconds of browser time per connection, so an hour is 120 units. Annual-billing prices: Prototyping $25 a month for 20,000 units (10 concurrent, 15-minute sessions, $0.0020 per extra unit), Starter $140 for 180,000 units (40 concurrent, 30 minutes, $0.0017) and Scale $350 for 500,000 units (100 concurrent, 60 minutes, $0.0015). Monthly billing costs $35, $200 and $500 and allows less concurrency: 5, 30 and 80. Residential proxies cost 6 units per MB, and each successful CAPTCHA solve 10 units.

Strengths. Chrome, WebKit and Firefox; BrowserQL, a GraphQL automation API; a hosted MCP server; authenticated profiles; and self-hosting on Docker or Kubernetes. Its trust centre lists SOC 2 Type II and GDPR, with a BAA on Enterprise and a DPA for deployments Browserless operates.

Limits. Sessions cap at 60 minutes below Enterprise, and stored data, including logs and replays, stays in the US even for sessions run in Amsterdam.

Best for: self-hosting in your own cloud or data centre, or non-Chromium engines.

Head-to-head comparison

Decision table

Two rules of thumb: if more than a fifth of sessions need residential proxies, model proxy cost first; if your agent waits seconds on an LLM per step, per-second billing with free idle time wins.

Worked cost example: 20,000 sessions a month

Scenario. 20,000 sessions a month, about 3 minutes each, up to 10 at once: 20,000 × 3 = 60,000 browser-minutes, or 1,000 browser-hours. Base case: headless where available, no proxies, each session ending inside 3:00. List prices only.

• Browserbase Developer: $20 + (1,000 − 100) × $0.12 = $20 + $108 = $128. Startup: $99 + (1,000 − 500) × $0.10 = $149.

• Steel Launch: 1,000 × $0.10 = $100 (the one-time $30 credit cuts month one to $70). Scale: $250, with the $80 of browser time covered by the $100 of monthly credits = $250.

• Kernel Hobbyist, headless: 3,600,000 seconds × $0.0000166667 = $60, plus the $30 fee, minus $10 of credits = $80. Headful: 3,600,000 × $0.0001333336 = $480 + $30 − $10 = $500.

• Hyperbrowser Startup: 1,000 hours × 100 credits = 100,000 credits = $100 (the $30 plan plus a $70 top-up). Scale is also $100.

• Browserless Starter (annual): 20,000 × 6 units = 120,000 units, inside the 180,000 allowance = $140. Prototyping: $25 + (120,000 − 20,000) × $0.0020 = $225.

Add residential proxies. Assume a quarter of sessions (5,000) load 4 MB each through a residential proxy, or 20 GB a month.

Rounding sensitivity. At 3 minutes 10 seconds per session, per-minute rounding bills 4 minutes on Browserbase and Steel, a 33% jump: Browserbase Developer rises to about $168 and Steel Launch to about $133. Browserless charges 7 units, still inside Starter; Kernel rises about 6%, to roughly $83.

Left out: model tokens, which usually cost more than the browser (size them with our LLM token counter), CAPTCHA fees, Kernel's free standby time and negotiated discounts. If your agents also need web search, our agent web search API cost comparison covers that bill.

Data residency: India, EU and US

No vendor here runs a public cloud region in India. The table shows the nearest options and where stored replays, logs and profiles end up.

Browserbase lists its four regions in its multi-region docs, and Hyperbrowser documents its five.

India and the DPDP Act. The DPDP Rules were notified in the Gazette on 13 November 2025, and most obligations, in Rules 3, 5 to 16, 22 and 23, take effect 18 months later, in May 2027. Rule 6 requires data fiduciaries to keep logs for one year as part of their security safeguards, longer than most default replay retention here. Section 16 of the DPDP Act lets the government restrict transfers of personal data to countries it notifies. A cloud browser logged into an HRMS or patient portal sees personal data in screenshots, cookies and pages, so treat the vendor as a processor: sign a DPA, disable replays you do not need and keep your own audit log. For data that must stay in India, self-hosted steel-browser or Browserless in an Indian cloud region is the practical route.

EU and US. Browserbase Frankfurt and Browserless Amsterdam keep execution in the EU, but stored data follows only on Browserbase Enterprise or self-hosting. US healthcare teams can get a BAA from Browserbase (Scale), Steel (Scale and Enterprise), Kernel (Enterprise) and Browserless (Enterprise).

Responsible use: site terms, robots.txt and bot protection

Every vendor here sells stealth, residential proxies or CAPTCHA solving; we list them as price-sheet items, not recommendations. Before an agent touches a third-party site, read its terms and robots.txt, prefer an official API, rate-limit, and automate only accounts your users have authorised. Solving CAPTCHAs on a site that forbids automation can breach contract and, in some jurisdictions, computer-misuse law. The better direction is declared identity: Kernel supports Web Bot Auth with Cloudflare and Browserbase offers it in beta, so sites can recognise signed agent traffic. Treat page content as untrusted input too; see our prompt-injection guardrails guide and our agentic browser data security controls.

Implementation checklist and migration notes

All five expose a Chrome DevTools Protocol WebSocket (Kernel's cdp_ws_url, Hyperbrowser's wsEndpoint, Browserless's tokenised wss:// URL), so a Playwright agent can switch vendors with an endpoint change. Keep it in configuration:

            import os
from playwright.sync_api import sync_playwright

# Vendor-specific CDP WebSocket URL, created by that vendor's session API
cdp_url = os.environ["BROWSER_CDP_URL"]

with sync_playwright() as p:
    browser = p.chromium.connect_over_cdp(cdp_url)
    context = browser.contexts[0]
    page = context.pages[0] if context.pages else context.new_page()
    page.goto("https://example.com")
    print(page.title())
    browser.close()
          

Before production:

1. Measure session length, idle share and proxy MB per session for a week. These decide the vendor more than list price.

1. Check concurrency headroom. Steel Launch and Kernel Hobbyist cap at 10; Kernel counts standby browsers against the limit; Browserless allows less concurrency on monthly billing.

1. Separate auth state from sessions with Contexts or Profiles, and keep credentials in a vault, never in prompts.

1. Set spend caps. Kernel and Browserless offer spending limits; Steel offers budget controls.

1. Set replay retention against DPDP, GDPR or HIPAA duties and disable recording for sensitive flows.

1. Expose the MCP server only to scoped hosts with per-tool permissions.

1. Watch lock-in. Stagehand and HyperAgent run on other providers' browsers; hosted agent APIs do not port.

If you are choosing between a browser agent and the model vendors' own computer-use tools, see our comparison of Gemini, Claude and OpenAI computer use and our guide to replacing RPA with computer-use agents.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our enterprise AI agent development service builds browser agents on these platforms and chooses between them using your own session data rather than list prices, covering the CDP integration layer, auth and profile handling, prompt-injection guardrails, spend caps and audit logging. Talk to us at /contact-us/.

Last updated: 22 October 2026.

References

1. Pricing — Kernel documentation

1. Pricing and limits — Steel documentation

1. Changelog 031 — Steel documentation

1. Configure a browser session — Steel documentation

1. Browserbase is now a platform — Browserbase

1. Changelog — Browserbase

1. ISO 27001 certification — Kernel

1. Web Bot Auth with Cloudflare — Kernel

1. Changelog — Browserless

1. Series B and beyond — Browserbase

1. Series A announcement — Kernel

1. Kitesurf — Cloudflare Browser Run documentation

1. Enterprise security — Browserbase documentation

1. Pricing — Browserbase

1. Plans — Browserbase documentation

1. Stagehand LICENSE (MIT) — GitHub

1. steel-browser repository (Apache-2.0) — GitHub

1. Steel homepage — Steel

1. Browsers on unikernels — Kernel documentation

1. Making browsers start faster — Kernel engineering blog

1. kernel-images LICENSE (Apache-2.0) — GitHub

1. Concurrency and limits — Kernel documentation

1. Proxies overview — Kernel documentation

1. Regional browsers — Kernel documentation

1. Pricing — Hyperbrowser

1. HyperAgent LICENSE (AGPL-3.0) — GitHub

1. Security practices — Hyperbrowser

1. Trust Center — Hyperbrowser

1. browserless LICENSE (SSPL-1.0 or commercial) — GitHub

1. Pricing — Browserless

1. Trust Center — Browserless

1. Multi-region — Browserbase documentation

1. Multi-region support — Hyperbrowser documentation

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) — Gazette of India

1. Digital Personal Data Protection Act, 2023 — Gazette of India

1. Web Bot Auth — Browserbase documentation