I built a free browser agent that never lets your AI key drain quietly, and then I tried to break it myself

Most AI browser agents ask you to trust them with two things: a real, logged-in copy of your browser, and an API key that spends real money every time it's used. Almost none of them tell you exactly what happens to either one. So I built Yad, a free and open-source browser agent, the opposite way: local-first, BYOK, and every security claim backed by a test you can read.

Here's the thing that made me actually want to write this up. Repeats cost nothing.

The problem nobody else seems to solve: your AI meter keeps running even when it shouldn't

If you've used Bardeen, HARPA, or Genspark for repeat browser tasks, you've probably run into this: you do the same task twice, and somehow the second run still burns credits like it's thinking from scratch. People complain about this constantly. Unpredictable credit metering is one of the top frustrations in the whole "AI does my browsing" category.

Yad's answer is an action-cache. The first run figures out the task. Every run after that reuses the exact same cached actions, zero further AI calls. Run the same task a hundred times and the AI meter doesn't move past the first. If you're on a free model or a cheap BYOK key, that's not a nice-to-have, that's the difference between actually using the tool daily and abandoning it after the trial task.

That's the feature I want leading this post, because it's the one that changes how the tool actually feels day to day.

How Yad works: two parts, and you need both

Yad isn't one thing, it's two, and being upfront about that matters:

Part A is the Chrome extension. It's the hand: it reads the page in front of you and clicks, types, and navigates on it, right inside your own real, logged-in browser. No cloud copy of your accounts sitting on someone else's server.

Part B is the Companion, a small free app you download and run once on your own computer. It's the brain: it's the only piece of Yad that ever does the actual AI thinking or touches your API key.

Part A alone can't think. Part B alone can't see your browser. Install both once, and you're set. (Companion is Windows-only for now, I'm not going to pretend otherwise.)

You bring your own AI key, Groq, Gemini, OpenRouter, a custom endpoint, or you run a model fully locally for free. Yad never holds or resells access to an AI on your behalf.

Here's what that actually looks like. Real task, real portal, no cherry-picking:

That last screenshot is the part I care about: it didn't just click buttons, it read the results and reported back a number.

Then I stopped trusting my own code and went after it

Here's where this gets a little unusual for a free extension.

Your API key is never stored readable, not even briefly. The first time you paste it in, it's sent once to the Companion, which locks it immediately with Windows' own built-in encryption (DPAPI), tied to your Windows account. The extension throws away the plaintext and keeps only the encrypted lock from then on.

I didn't want to just assume that works, so I proved it: real packaged installer, completely clean folder, zero prior state, the way an actual new user experiences it. A freshly started Companion, in a different folder, took nothing but the encrypted lock and correctly unlocked the key. Feed it a corrupted lock instead, and it fails safely, no crash, nothing activated.

There's also a daily spend cap (1000 calls a day by default, you set it) and a one-click Stop button, both enforced at the single choke point every AI call has to pass through, and both fail closed if the saved state is ever missing, meaning Yad blocks by default instead of quietly letting a runaway task keep spending.

Before any of this shipped, the security code went through an 18-agent, AI-driven adversarial code review that I designed and ran myself against my own code (I want to be precise here: not a third-party firm, not a paid pentest, not a certification, just a rigorous automated process trying to break the code from three angles). It found 12 real, confirmed issues, including a kill switch that didn't actually survive a restart, and a subprocess launch that could have let a planted fake binary intercept a key. All 12 got fixed and re-verified with live end-to-end tests through the real wire protocol Chrome uses.

Then I went further and attacked the running app myself, the way someone with bad intentions would:

• Eleven ways to sneak a payment page past the checkout guard (capital letters, double URL-encoding, hash-route hiding, path traversal, a null byte). All eleven caught.
• Five dangerous link types a page could hand the agent, including one meant to run arbitrary code in the browser. All five refused.
• A DNS-rebinding attempt on the Companion's local control channel, the exact trick a malicious webpage uses to make itself look local. Blocked, including on the routes that can read files or run JavaScript.
• Garbage bytes, a fake multi-gigabyte message length, and an oversized message thrown at the wire protocol between the two parts. The process didn't blink.
• The daily cap tested right at its exact numeric edge, and a hundred simultaneous kill-switch toggles fired at once hunting for a race condition. Clean on both.

Everything above is documented in detail, including the parts that were genuinely bugs before I fixed them, on Yad's Security page. I'd rather show the receipts than ask you to take my word for it.

The honest part: what I'm not claiming

Owning your limits is part of the engineering, not legal cover bolted on afterward. So, plainly:

• Not SOC 2, not ISO 27001. Nobody has certified this.
• Not a third-party audit. The adversarial review above is my own process, on my own code, before release. Real and rigorous, not the same thing as an outside audit.
• Not a paid penetration test.
• Never "unhackable," "bank-level," or "100% secure." Those phrases don't mean anything you can verify, so I don't use them, no matter how proud I am of the work.

Also honest: this is a solo/small-team project, not a funded company. The installer is currently unsigned, so Windows SmartScreen will warn you about an "unknown publisher" the first time you run it, that's a real trust hurdle I haven't solved yet and I'd rather tell you now than have you hit it cold. And the two-part install is more friction than a single-extension competitor. If a completely frictionless, single-click experience matters more to you than what happens to your key, there are tools built for that instead.

Who this is actually for

If you already have a Groq or OpenRouter key and you've read about cloud browser agents sending your real session data to someone else's server, this is built for you. If you run Ollama locally and want the whole stack, extension and AI, to cost exactly zero, same. If you're doing genuinely repetitive browser work and got tired of Bardeen or Axiom's subscription pricing, the action-cache alone probably pays for the two-minute install.

If you just want an AI sidebar that works with zero setup and you don't care where your data goes, honestly, install Comet or whatever's already bundled with the AI subscription you're paying for. I'd rather tell you that than pretend Yad is for everyone.

Try it

• Chrome extension: Add Yad to Chrome
• Companion download + full docs: wazir-x402.duckdns.org/yad
• Every security claim, with the proof: wazir-x402.duckdns.org/yad-security
• Source: it's open source, read the code yourself

If you try it and something breaks, or you find a hole I didn't, I want to hear about it. That's the whole point of publishing the receipts.