OpenAI's Operator, launched in early 2025, is asked to book a flight or fill out a government form, and it does what a human would do: opens a browser, navigates to a page, and starts clicking. What it runs into almost immediately is a web that was never designed to be operated by something other than a person — CAPTCHAs meant to distinguish humans from bots, layouts that shift between A/B test variants, and terms of service that, on some sites, explicitly prohibit automated access at all.
This is a fundamentally different problem from the one language models solved first. Answering questions well required understanding language. Operating a browser well, the way Operator or Anthropic's computer-use Claude must, requires understanding a visual and structural environment built page by page with no shared standard for what a button or a form field should look like to software trying to interpret it. Agents handle this by pattern-matching against layouts they have seen before, which breaks the moment a site redesigns its checkout flow.
CAPTCHAs are the most visible friction point and the most philosophically interesting one. They exist specifically to block automated access, which means Operator, by design, is trying to defeat exactly the mechanism the web built to keep automation out. This puts OpenAI and website operators in a structurally adversarial relationship that neither side asked for: the website wants to know a human is present for reasons from fraud prevention to ad revenue integrity, and Operator's entire value proposition depends on convincing the website otherwise.
Terms of service compound this into a legal gray zone rather than just a technical one. Many websites explicitly prohibit automated scraping or interaction, and an agent acting on a user's behalf is, in a formal sense, often violating those terms even when the user would be entirely within their rights to perform the same action manually. This creates an odd asymmetry where the same task is permitted for a human and prohibited for their software proxy.
Website operators are responding in two directions simultaneously. Some, aware that Operator, Google's Project Mariner, and Perplexity's Comet browser are not going away, are building explicit agent-friendly interfaces and structured APIs, recognizing that fighting automation entirely is a losing and increasingly costly battle. Others are hardening their defenses further, treating agent traffic as adversarial by default and investing in more sophisticated bot detection that raises the cost for legitimate and illegitimate agent use alike.
The businesses most affected are not necessarily the ones building Operator or Comet but the ones whose revenue model depends on the browsing experience staying human-mediated — sites funded by display advertising that assumes a human will see the ad, retailers whose promotional timing assumes human browsing patterns rather than an agent checking prices every few minutes.
None of this is likely to resolve into a clean standard quickly, because the web was never built with a governance body positioned to declare one. What is more likely is a slow, uneven negotiation — sites carving out agent-friendly paths where it serves them, hardening against Operator and its competitors where it does not, and a growing body of contested cases in between that neither engineering nor policy has caught up with yet.