building a claw in the browser | AI Focus<br>building a claw in the browser<br>Published by<br>Paul Kinlan

on: May 22, 2026; Reading<br>time:<br>16<br>minutes<br>Expand to see summary

What is described here in this project is dangerous, it can get pretty much full access to everything inside your browser and could enable control of your browser from outside it

I really do believe we are witnessing a transition in how we build and run software. This entire blog is dedicated to my explorations in this space, for example, I wrote about why the browser is the sandbox which explains how we can use the web platform&rsquo;s battle-tested security boundaries to execute untrusted code. But sandboxing is only half the battle, when what remains is the utility of any of this technology.<br>A lot of the people in the web industry that I&rsquo;ve followed over the years are either actively against the changes in technology or are not yet aligned with it and see no value, or consider it actively harmful.<br>Outside of the considerable utility that I get with coding-tools, OpenClaw was the first project where I could really get a handle on how computing really will change and that model has become 2nd nature to me now. If you are not familiar with it, you can give your LLM of choice access to your system by connecting them directly to messaging platforms, filesystems, and execution environments to perform real-world tasks on your behalf. It can then act as a local autonomous agent with unrestricted native filesystem and network privileges, which while incredibly risky has been a platform-changing moment.<br>It got me thinking: Could we build a Claw-like system entirely inside the browser?<br>Yes we can, and I did. This post will deep dive into the system I&rsquo;ve built.<br>I&rsquo;m calling it Chaos (Chrome Agent Operating System&mldr; yes, I did think of the name first). Chaos is, well, Chaotic. It is a demonstration of a multi-agent browser-based environment packaged as a Chrome Extension (Manifest V3) that coordinates a relay server to act as a complete, sandboxed agent runtime.<br>Seriously, this is a demo. It&rsquo;s not a product. It&rsquo;s not official. It&rsquo;s dangerous. You will be burnt if you play with this!!

For a quick overview of what this project does without having to risk an install, you can watch:

What follows is a deep dive into the actual architecture, capabilities, and mechanics under the hood of Chaos, and why the browser might just be the ultimate operating system for AI.<br>Chaos Dashboard showing suggested prompts and recent artifacts<br>The Chaos Architecture<br>At its heart, Chaos is packaged as a Chrome Extension. I’ve written before about how Chrome extensions are the closest thing we have to a declarative agent packaging format. They declare their permissions upfront in a manifest, their lifecycle is event-driven, and they run inside V8 isolation.<br>To achieve this cleanly, Chaos is built as a decoupled monorepo using npm workspaces. Modularity is exceptionally high, splitting codebase concerns into separate, cohesive packages:<br>packages/extension: The Chrome extension host client (background script, OPFS integration, app UI).<br>packages/agent-loop: A provider-agnostic autonomous execution loop wrapping [agent-do](/agent-do-my-agent-loop/.<br>packages/sdk: A shared TypeScript library containing an API surface for the Hooks and Channels that are a layer above the agent-loop, type definitions, and protocol schemas.<br>packages/tui: A terminal-based React Ink dashboard to show the concept working without the extension.<br>packages/server: Deno Deploy relay server.<br>Chaos structures this environment to act like a mini-OS, split between a Chrome extension frontend and a Deno Deploy relay server:<br>+------------------------------------------------------------------+<br>| Chrome Extension (Manifest V3) |<br>| |<br>| +------------------+ +-------------------+ |<br>| | app.html (UI) | | background.ts | |<br>| | - Agent columns || (Service Worker) | |<br>| | - Task board | | - Message routing | |<br>| | - File explorer | | - Hook listeners | |<br>| +------------------+ +--------+----------+ |<br>| | | |<br>| v v |<br>| +------------------+ +-------------------+ |<br>| | IndexedDB | | OPFS | |<br>| | - Conversations | | - agents/{id}/ | |<br>| | - Page cache | | CLAUDE.md | |<br>| | - Vector cache | | memories/ | |<br>| | - WASM binaries | | - shared/ | |<br>| +------------------+ +-------------------+ |<br>+------------------------------------------------------------------+<br>| WebSocket + HTTP polling<br>+------------------------------------------------------------------+<br>| Relay Server (Deno Deploy + Deno KV) |<br>| - REST API / WebSocket pairing |<br>| - Webhook channels & Telegram Bot bridge |<br>+------------------------------------------------------------------+<br>1. The Master Agent & Sub-Agent<br>Chaos does not rely on a single agent. Instead, it implements a hierarchical master-worker system.<br>The Master Agent : The first agent initialized on installation is the Master. It has exclusive access to system-management tools...