Kitesurf Beats Chromium on Cost. It Still Loses This Fight.

Cloudflare shipped a browser built for AI agents, not humans. It's 3 to 7x cheaper to run than Chromium — and it can't do half the jobs you're actually running today.

If you're running any agent that opens a browser — screenshotting a competitor's pricing page, scraping a directory for lead gen, pulling HTML for a RAG pipeline — you're almost certainly doing it through Chromium. Playwright, Puppeteer, Browserbase, Browserless: different wrappers, same engine underneath, same CPU and memory bill. On August 6, Cloudflare shipped Kitesurf, a browser built from scratch in Rust and WebAssembly, running inside Workers' V8 isolates instead of a stripped-down Chrome. Cloudflare's own benchmark: 3 to 7x less CPU and memory per job than Chromium, same Puppeteer and Playwright code, one parameter added. For anyone running agent fleets that open browsers at real volume, that's not a rounding error — CPU-ms and memory footprint are exactly what serverless platforms bill on. The catch is what Kitesurf can't do yet, and it's a real list, not a beta-software footnote.

The numbers, straight from Cloudflare's own benchmark

Cloudflare ran both browsers against the same 14-URL corpus, five runs each, and published the medians. Nobody's independently reproduced this yet — treat it as a vendor number until someone reruns the test — but the gap is too wide to be noise:

Story: Cloudflare — Introducing Kitesurf. Image via TechCrunch.

Chromium still wins on raw speed — rasterization and image encoding are where Kitesurf pays its tax. But wall-clock time isn't what shows up on your invoice. CPU-ms and memory footprint are. [1]

What Kitesurf can't do yet — and this is the part that actually decides the argument

Cloudflare's own docs are blunt about it. Kitesurf is "not yet the right option" for three jobs: playing video or rendering WebGL, negotiating a bot-challenge handshake that needs a real TLS fingerprint, and holding a long-running authenticated session with persistent state. [2]

Translate that into operator language. If your agent needs to log into a client's dashboard and stay logged in, scrape a site that fingerprints real Chrome before it'll show you anything, or touch a video element, Kitesurf isn't in the running yet. Those aren't edge cases — they're most of the browser-automation work that actually pays.

The decision rule

Here's the split I'd run, not a hedge:

• No login, no anti-bot wall, no video — a directory scrape, a competitor price check, HTML extraction for a RAG pipeline — send it to Kitesurf. Adoption cost is one query parameter on tooling you already have. [1]
• Anything logged-in, anti-bot-gated, or touching video — client dashboards, sites with real bot-challenge handshakes, anything rendering media — keep it on Chromium. Kitesurf can't do the job at any price yet.

flowchart TD
  Start([Browser task for an agent]) --> Q1{Screenshot or<br/>HTML/text extraction only?}
  Q1 -->|No — needs a<br/>logged-in session| UseChromium1[Use Chromium]
  Q1 -->|Yes| Q2{Needs video, WebGL, or a<br/>bot-challenge TLS handshake?}
  Q2 -->|Yes| UseChromium2[Use Chromium]
  Q2 -->|No| UseKitesurf[Use Kitesurf<br/>browser=kitesurf param]
  UseKitesurf -.->|3-7x less CPU + memory<br/>per Cloudflare's benchmark| Payoff([Lower agent infra cost])

That's not "pick one browser for every agent." It's a router in front of your agent's browser calls — Kitesurf for the stateless majority, Chromium for the rest.

The cost delta, honestly

Cloudflare hasn't published GA pricing for Kitesurf. It's free in beta, capped per account. [2] So I can't hand you a dollar figure, and anyone quoting one right now is guessing. What I can tell you: Workers billing runs on CPU time, and browser-rendering products bill on session duration, not just wall clock. A 3-7x cut across the two dimensions serverless platforms actually charge for is a direct line to your invoice once real pricing lands — not a maybe. If you're running a fleet of scraping or extraction agents at real volume, that's the number to watch for, not the beta announcement itself.

Wall-clock speed doesn't show up on your invoice. CPU time and memory footprint do.

Who actually wins

Head-to-head, straight up: for the narrow lane it's built for — stateless screenshot and extraction jobs, no login, no anti-bot wall — Kitesurf wins outright, and the switching cost is close to zero on tooling you already run. [1][3] For everything else, Chromium still wins by default, because Kitesurf can't do the job at any price yet.

Kitesurf isn't an isolated bet, either. The same week it shipped, Docker took Docker Sandboxes GA — disposable microVMs that let Claude Code, Copilot CLI, Codex, and other coding agents run with permissive, --dangerously-skip-permissions-style autonomy while keeping "only your project workspace mounted in" and the host untouched. [4] Different layer of the stack, same instinct: stop giving an agent the whole general-purpose environment and start giving it a scoped, disposable one built for exactly the job in front of it. I wrote about the same shift in agent identity and sandboxing after the Grok Build CLI incident — V8 isolates and short-lived, scoped execution are becoming the default shape for anything you let an agent touch, not just browsers.

Sources

[1] Cloudflare — Introducing Kitesurf: The agent-first browser that runs in V8 isolates on Cloudflare Workers — blog.cloudflare.com [2] Cloudflare Developers — Kitesurf · Browser Run docs — developers.cloudflare.com [3] TechCrunch (Sarah Perez) — Cloudflare launches Kitesurf, a browser built for AI agents — techcrunch.com [4] Docker — Docker Sandboxes: disposable, isolated sandboxes for AI agents — docker.com

If you're running client automation that opens a browser today, don't rip out your Chromium stack over a six-day-old beta. Add the browser=kitesurf flag to your least-risky, highest-volume job — a directory scrape, a competitor price check, anything stateless — and watch what it does to that job's cost line before you trust it with anything that logs in. That's the same audit-first instinct that turned The Hub's stack into a setup running at 60% lower cost: don't swap infrastructure on a vendor's benchmark, swap it on your own measured delta. If you want a second set of eyes on which of your agent jobs are cheapest to move first, that's the kind of audit I run.

The short version

• Cloudflare's Kitesurf browser (shipped August 6) uses 3-7x less CPU and memory than Chromium for agent screenshot and extraction jobs, per Cloudflare's own benchmark
• It can't do video, WebGL, bot-challenge TLS handshakes, or persistent authenticated sessions yet — that's most of the browser-automation work that actually pays
• Switching cost is one parameter (browser=kitesurf) on Playwright, Puppeteer, or CDP code you already have
• No GA pricing yet — it's free in beta, capped per account, so any dollar figure right now is a guess
• The real move: route stateless, no-login jobs to Kitesurf, keep everything else on Chromium, and measure your own delta before trusting the vendor benchmark