When Your AI Agent Acts Without Asking You First

Magnus Müller's AI agent resolved a naming dispute with OpenAI's Codex team before he even knew the dispute was being handled. The agent spotted a complaint in Slack, identified the right contact at Codex, drafted and sent an email, monitored a random tweet from a user who couldn't find a plugin, inferred from that tweet that the rename had happened—and reported back to Müller. The official confirmation email from the Codex team arrived a day later.

"How crazy is this," Müller said in a recent conversation on the David Ondrej podcast, "that the agent did this completely on itself, decided the goal, did the entire process, and told me before the Codex guy even told me that it's resolved?"

Crazy is one word for it. The other word—the one that keeps coming up in Müller's telling—is ownership. Specifically, the loss of it.

Müller is the co-founder and CEO of Browser Use, an open-source framework that lets AI agents navigate browsers the way a human would—clicking, reading, filling forms, comparing products across tabs. The project started as a two-day weekend hack when he and his co-founder were sleeping on sofas in a university co-working space, eating microwave food, and wondering what would happen if you could just tell a computer what to do. They launched on Hacker News, made the repo public on a whim ("it was like a two-minute decision"), and the thing took off.

The framework has since attracted real-world usage that reads like a checklist of tasks we all quietly hate: paying parking tickets, researching speaker purchases across Reddit threads and Amazon listings, signing up for government appointments. One user, Müller says, just sent a picture of a ticket and said "handle this for me." The agent handled it.

What's notable here isn't the capability itself—browser automation has existed in various forms for years, from Selenium scripts to RPA tools that large enterprises have spent billions on. What Müller is describing is something different: capability that's reliable enough and legible enough that ordinary people are starting to trust it with their credit cards and their inboxes. That trust, he argues, is the actual product milestone. Not the technology.

But here's where Müller's thinking gets genuinely interesting, and where I think the conversation moves past the usual "AI can do everything now" demo reel.

His central claim isn't that agents are powerful. It's that the main bottleneck is no longer technical—it's the interface problem. Specifically: what do you even prompt a system capable of anything?

"Imagine you have AGI in the cloud," Müller said. "If you can do higher and higher workflows, what do you prompt such a system? You tell them your goals. Maybe before your goal was to change your website a bit. But now maybe you don't even care about your website anymore."

This is worth sitting with. The entire AI assistant paradigm—from Siri to ChatGPT—has been built on the assumption that you supply the task. You know what you want, you articulate it, the system executes. That's a reasonable model when the system's capability is narrow. But as the capability envelope expands, the prompt-writing burden on the human becomes the actual friction point. If an agent can do almost anything, being good at telling it what to do becomes its own specialized skill. That's a weird outcome.

Müller's proposed inversion: let the agent do the prompting.

His current setup has an agent running in a loop every thirty minutes, scanning his Gmail, Slack, WhatsApp, and GitHub, then surfacing suggested actions to him via Telegram. He doesn't write instructions; he reviews decisions. The interface, as he describes it, is essentially Tinder—swipe right on "send this follow-up email," swipe left on "post this to LinkedIn." Three seconds per card. Approve or reject.

"I really love this kind of new interface," he said, "because we just need to press buttons."

There's something seductive about that framing, and something worth interrogating too.

The Tinder metaphor is doing a lot of work here. Tinder is fast and easy precisely because the decision is low-stakes—you're not approving a business communication on behalf of your company, you're filtering a photo. The agent-approval loop Müller describes is not low-stakes. When he approved "send now" on the message pitching a client, an actual business communication went out under his name (or at least his company's name) based on the agent's read of a situation. The human in this loop is being asked to make quick judgments on actions they didn't initiate and may not have full context for—which is, by design, the point.

Müller is aware of the psychological texture of this. He talks about a "weird feeling" of lost ownership, and notices that when the agent initiates rather than executes, he starts to "care less." He's also observed that he's less likely to commit to ideas that come from the agent than to identical ideas he'd have come up with himself—which led him to prompt the agent to sell him on its suggestions, to make the case for why each one matters.

That's a strange loop to be in: designing a system to persuade you to do the things it thinks you should do, based on goals you set at a level of abstraction high enough that you've essentially delegated judgment wholesale.

None of this is a knock on Müller or Browser Use specifically. The open-source-first approach he describes—model-agnostic, harness-agnostic, deliberately avoiding lock-in—is genuinely good for users. And his observation that the big labs (he mentions OpenAI and Anthropic) have moved slower than expected on browser agents is accurate; the capability existed conceptually before the tooling around it matured. Small focused teams often move faster on specific, bounded problems than organizations with broader mandates. That's not a new story, but it keeps being true.

What I find worth watching—and what this conversation only gestures at—is the accountability layer. When an agent initiates a business interaction on your behalf, negotiates a rename with an external team, and resolves it before you're even aware it was in progress, the traditional chain of responsibility gets murky. Müller experienced this as novel and exciting. In a regulated industry, or in a context where the stakes are higher than a plugin name, the same experience might play out very differently.

The founder of Hugging Face, according to Müller, couldn't find a single task that doesn't work with current agents. Maybe that's true. But "works" and "should be delegated" aren't the same question.

The interface problem Müller identifies is real, and his instinct—that the agent should prompt the human rather than the other way around—is the most genuinely novel idea in this conversation. It's also the one that inverts most of the assumptions baked into how we've thought about human-computer interaction for fifty years.

The challenge he sets at the end is clarifying: the people who will get the most from these systems are those who can describe their goals at the highest level of abstraction, and those whose "taste"—which ideas to approve, which to reject—is calibrated well enough to serve as a reliable filter.

That's a very different skill than prompt engineering. It's closer to management. Or, if you're feeling less generous about it, delegation without oversight.

Marcus Chen-Ramirez is a senior technology correspondent at Buzzrag. He covered software infrastructure before covering the people who build it.