Abstract
The Agent Saw “Save,” the Page Clicked Something Else: Correlating Browser-Agent Actions with Real External Effects Across Layout Shifts, Iframes, Redirects, Background Requests and Retries
Browser and computer-use AI agents act on screenshots, DOM snapshots and accessibility trees. Between the moment an agent sees a “Save” button and the moment an external system changes, much can go wrong. An overlay or layout shift can send the click to another element. The element may sit in a third-party iframe from a different origin. A redirect can change the destination or the HTTP method. A service worker or timer can send requests no one clicked. A delayed submission can carry a changed form value. An HTTP 200 or a success banner may not mean the remote transaction committed, and a retry after an uncertain result can duplicate a payment.
This disclosure describes a vendor-neutral, non-actuating method for correlating an original authorized task with the browser evidence and the external effect it actually produced. Each task carries a stable identity, principal, allowed effect and approval generation. Observations are qualified by DOM generation, viewport and focus, and the intended control is requalified by a fresh hit-test against the element that actually received the event. Frame identity, origin, navigation and redirect chains are reconstructed so that being on a page never confers authority. Every effect-producing operation, including those originating from workers, timers and APIs, is tied back to the original task lineage, and the actual method, destination, payload and idempotency key are compared with what was approved under current authority and path coverage. External completion is established only from authoritative evidence, and retries are permitted only when the prior effect’s status is proven. Twelve expected-versus-actual comparisons and further mandatory predicates are combined in three-valued logic: a contradiction yields INCONSISTENT and is never cancelled by missing evidence, full support yields CONSISTENT, and gaps yield UNRESOLVED.
The document provides a 48-stage, six-phase engineering workflow with flowcharts, 48 technical invariants, six detailed embodiments, 43 formal relations with conditional proofs and 40 engineering checkpoints. It compares the method with WebDriver and CDP automation, Playwright actionability checks, DOM and accessibility APIs, browser same-origin and sandbox policies, CSP and Fetch Metadata, HTTP idempotency keys, saga and outbox patterns, and agent guardrails. A non-actuating reference evaluator in Python, JavaScript and Go passes 74 shared synthetic test vectors. It is not a browser engine or an interception product; the laboratory is synthetic, self-authored and not peer reviewed.
Industry relevance: The problem addressed applies to AI developers shipping browser and computer-use agents (for example Anthropic’s Claude computer use and Chrome agent, OpenAI’s Operator and ChatGPT agent, Google’s Project Mariner and Gemini in Chrome, Microsoft’s Copilot actions and Playwright, and Amazon’s Nova Act). It also applies to browser vendors and automation standards such as WebDriver BiDi and the Chrome DevTools Protocol, to defences against prompt injection on web pages, and to enterprise automation, SaaS and payment platforms that agents operate through web interfaces. This industry-relevance statement is AI-generated and does not assert that any named company uses, implements or infringes the disclosed method. Readers are strongly advised to read the original PCT filings before drawing any conclusion.
This disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026, which claims priority from PCT/IB2026/053385, filed April 2026 and publicly disclosed 4 June 2026. The author is open to strategic collaboration, licensing or acquihire discussions.
Keywords: browser agent; computer-use agent; AI web agent; agentic browser; browser automation; DOM snapshot; accessibility tree; screenshot grounding; hit testing; layout shift; clickjacking; overlay; iframe; cross-origin; same-origin policy; redirect chain; service worker; background requests; form submission integrity; TOCTOU; HTTP idempotency key; duplicate payment prevention; retry safety; external effect verification; prompt injection; three-valued logic; WebDriver BiDi; Chrome DevTools Protocol; Playwright; AI agent safety.
Suggested CPC classes (for search): G06F 9/451; G06F 21/53; G06F 21/554; G06F 11/3438; G06F 16/958; H04L 67/02; H04L 63/1466; G06N 5/04.
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "Clicked Is Not Committed: Proving What a Browser or Computer-Use AI Agent Actually Changed in the Outside World", Technical Disclosure Commons, (November 09, 2026)
https://www.tdcommons.org/dpubs_series/12824