Codex Stops "Look, Guess, and Click" — Introducing 'Site Tools,' Where Sites Hand Over Their Own Tools, Plus Support for 5 Browsers

On August 25, OpenAI shipped browser-related updates to its coding agent "Codex" and "ChatGPT Work." The centerpiece is Site Tools, which lets agents directly call the "tools" that a website itself provides. OpenAI also expanded extension support to five browsers and added sign-in for cloud-side browsers.

It looks like a modest update, but at its core lies a shift in how agents are meant to operate a screen.

From guessing via screenshots to calling declared tools

Until now, AI that operated a browser took a screenshot, guessed where an element was, and mimicked mouse actions. Misread the DOM and it clicked the wrong thing; behavior was unstable.

Site Tools builds on WebMCP, a mechanism that engineers from Google and Microsoft are advancing in a W3C community group. Announced in February 2026, it is currently at the experimental stage (an origin trial) in Chrome 149.

With WebMCP, the site annotates its JavaScript functions and HTML forms, declaring "what you can do on this page" as tools accompanied by a JSON schema. Instead of guessing at the screen, the agent simply calls the declared functions. Control is inverted: the site hands the agent "what it can do."

The difference from MCP is also easy to frame. Ordinary MCP was "vertical" plumbing that connected an agent to a database or API. WebMCP provides the "horizontal" layer that connects the agent to the website right in front of it.

The three changes Codex received this time

The update breaks down into these three points.

The facts that Site Tools is limited to specific models (Sol/Terra) and that Enterprise/Edu are excluded become important premises when considering unattended, large-scale operation.

What it means for developers

The implications for builders are clear. Add WebMCP annotations to your own site and agents will operate based on declarations rather than guesses. Mis-clicks and hallucinations drop, and use through an agent becomes stable.

Put differently, the website of the future is at once "a screen for people to view" and "an API for agents to call." Design that gives forms and buttons machine-readable meaning is starting to become part of UI design.

The impact on business

If an agent can reliably call a site's features, it becomes easier to delegate routine work such as reservations, purchases, and operating internal systems. There's potential to replace screen-dependent, fragile RPA with stable, declaration-based integration.

That said, adoption is still ahead of us. WebMCP is centered on experimental availability in Chrome-based browsers, and cross-browser support is targeted for the latter half of 2026 or later. Codex's Site Tools is likewise limited to the built-in browser and specific models, so for the time being it's a feature that "only works in certain places."

Still experimental, and gaps are being flagged

Behind the convenience, there are concerns being raised. When a site opens its tools to agents, it also means a new attack surface is added. The risk remains that a malicious page could declare rogue tools, or that a prompt injection could induce unintended actions.

As a countermeasure, WebMCP provides origin isolation and a Permissions Policy for tools (allowing same-origin only by default). Cloud sign-in is likewise designed to separate the session from your local one. Even so, because the agent operates within an authenticated session, permission design and audit logging remain homework for the operations side.

For now, treat it as an experimental early preview, and it's prudent to keep a human in the loop for high-impact actions such as payments or publishing.

References: ChatGPT & Codex changelog / Codex Updates by OpenAI (Releasebot) / WebMCP | AI on Chrome (Chrome for Developers) / Chrome at Google I/O 2026