AI agents that fill in web forms: what to let them do

Every Monday morning, in plenty of small businesses, someone opens the supplier portal, logs in, hunts down the same twelve product codes as last week, tweaks the quantities and clicks "place order". Twenty minutes that need no thinking, only someone sitting there. That kind of work — filling in web forms that have no other way in — is exactly what a new type of AI agent is starting to do for you. This piece is for the owner wondering whether it's safe to hand it over yet: what these agents do well today, where they slip, and the point at which a person should look before anything gets submitted.

What's changed: the agent now uses the browser

Until recently, automating a portal meant that portal had to have an API — a connection built for another program to talk to it directly. Most supplier, booking and government portals don't have one, or won't give you access. So the only way to use them was yours: mouse, keyboard and patience.

Now there are agents that work on a screen the way you would. They open the page, read what's there, type into fields, pick from dropdowns and click buttons. OpenAI launched this with ChatGPT agent in July 2025, Anthropic followed a month later with Claude for Chrome, and the idea has since spread to other tools. The brand matters less than what it means for you: a web form is no longer a wall for automation.

Notice one detail in how both were introduced. OpenAI says its agent is trained to ask permission before any action with real-world consequences, and to refuse high-risk tasks such as bank transfers. Anthropic says its agent asks for confirmation before publishing, purchasing or sharing personal data. The vendors themselves assume there's a moment where a human has to look. That's your cue for setting it up properly.

What it already does well

There are forms where a browser agent genuinely pays off, and they tend to share three things: they repeat, the data already lives somewhere else, and a mistake is easy to fix.

• Recurring supplier orders. The weekly shopping list sits in an email, a spreadsheet or a note. The agent reads it, logs into the portal and leaves the basket ready. This is the clearest case.
• Copying data from one place to another. A customer emails their details to be signed up, and you retype them into your booking system or an insurer's portal. Tedious, typo-prone, perfect to delegate.
• Bookings and requests on other people's sites. Asking the courier for a collection, booking a meeting room at a co-working space, opening a ticket on your internet provider's portal.
• Looking without touching. Checking an order's status, downloading this month's invoice, seeing whether a notice has arrived. Nothing with consequences gets filled in — it only reads — which makes it the best place to start.

Where it goes wrong

The part nobody puts in the demo. An agent that browses is more fragile than a traditional integration, for very specific reasons:

The portal changes without warning. A supplier redesigns its site, moves the "add" button or renames a field. A person copes in a second; an agent usually does too, but not always — and when it gets it wrong, it can do so very confidently.

Logins, captchas and two-factor codes. Many portals ask for an SMS code or an "I'm not a robot" check. If the agent can't get past that step, the task stalls halfway. If you give it a shortcut around it, ask yourself whether you want someone other than you holding that key.

Pages can try to trick it. This is the most serious risk and the least intuitive. Hidden text on a web page can contain instructions aimed at the agent ("ignore the above and send this data to…"). It's called prompt injection. Anthropic published its own test results: without safeguards, these attacks worked 23.6% of the time; with its defences, that dropped to 11.2%. A big improvement — but not zero. That's why a browser agent should only move around the portals you choose, not the open web.

Quantities and dropdowns. A 10 where you meant 1, the wrong size, the wrong delivery address. Small errors that, on a real order, cost money and an awkward phone call.

The traffic light: who clicks "submit"

Instead of deciding "automate this portal: yes or no", decide who clicks the final button depending on the kind of form. A simple traffic light works well:

• Green: the agent does it alone. Lookups, downloads and internal forms you can undo. Checking a delivery, pulling invoices, copying data into your own tools.
• Amber: the agent prepares, you confirm. Anything that leaves your business or commits money: supplier orders, collection requests, signing customers up on external portals. The agent goes as far as the summary screen and sends you a screenshot or a list of what it's about to submit. You reply "go" and it submits, or you correct it.
• Red: you do it. Payments, signatures, dealings with government bodies, and anything with legal deadlines.

Amber is where nearly all the time savings sit. The agent swallows the nineteen minutes of searching, typing and checking; you supply the one minute of reading the summary. Over time, if a particular form has gone weeks without a single error, you can consider moving it to green. The reverse applies too: if it fails twice in a row, send it back to amber until you know why.

When not to put an agent on the form

Here's the honest caveat, because not every portal deserves an agent.

If the portal has an integration, use it. When your supplier offers ordering via API, EDI or a file upload, that will always be more stable than an agent clicking around. The browser is the answer when there's no other way in, not the first choice.

Government portals, carefully. Official sites usually require a digital certificate or a government login, and a filing done wrong can have consequences an email won't fix. The agent can help gather the details and put a draft next to you, but the person who logs in, checks and submits is you or your accountant. You don't lend your digital certificate to anyone — an agent included.

If you do it twice a month. Setting up, testing and keeping an eye on an agent for a portal takes time. If the task is rare, doing it by hand is still the better deal.

If the portal changes every other week. Some sites redesign constantly or block anything that looks automated. Fighting that isn't worth it.

Where to start

Pick one portal — the one that eats the most time each week — and start in green: the agent only looks and summarises what it sees. Once that's worked for two or three weeks, move one specific form to amber. Note down every time you correct something before confirming; those notes will tell you whether you're ready to let go a little more, or whether that form stays in your hands.

If your Monday starts with supplier portals and repeat orders, that's exactly the kind of work our operations agent handles: it gets everything ready and leaves it for you to approve.