Claude Managed Agents in Practice: ai-newtab Turns Browsing History into a Daily Homepage

An Open-Source Experiment That Rewrites the New Tab Page with Claude

Browser new tab pages are among the most frequently visited interfaces on the internet, yet they have long remained stuck in the form of "search box + frequently used site icons." An open-source project called ai-newtab attempts to change this: it hands the user's browsing history to a Claude Managed Agents session for processing, generating a personalized homepage that updates daily, with the entire workflow driven by a Chrome extension.

This is not just another "AI summary" plugin, but a complete validation of the Managed Agents architecture in a small-footprint client scenario. The teardown notes in the project source reveal several noteworthy questions: how this loop actually runs, what the extension sends to the API, whether the cost claims hold up, and which security gaps must be closed before copying it.

How the Loop Closes

The core logic of ai-newtab can be broken down into four stages.

Collection: The extension reads browsing history locally and filters out recently visited pages.

Submission: This data is packaged and sent to a Claude Managed Agents session. The key word here is "Managed"—developers don't need to build their own backend for agent orchestration, tool calling, and state management; Anthropic's hosted service handles that part.

Generation: Based on the input history data, the session produces that day's homepage content—possibly a set of recommended links, an overview text, or some kind of thematic aggregation.

Rendering: The extension receives the returned result and replaces the browser's default new tab page.

This architecture has its shortcuts and its costs. The shortcut is that Managed Agents outsources the complexity of the agent lifecycle to the platform, allowing a Chrome extension author to implement "stateful, iterable" AI features with relatively little code. The cost is that the user's browsing history must leave the local device and enter a third-party API.

Claude Managed Agents is a type of hosted agent service provided by Anthropic: developers declare task goals and available tools via API, and the platform handles runtime aspects such as session state persistence, tool call orchestration, context management, and failure retries. Compared to the traditional bare API pattern of "writing your own while loop + function calling," the managed model abstracts the agent's "lifecycle" into a platform-side black box, where the client only needs to submit input and receive output. For small-footprint scenarios like Chrome extensions that lack server-side infrastructure, this means you can achieve "stateful, multi-turn iterative" AI behavior without building your own session storage, task queues, and state machines. The cost is that runtime behavior is partially uncontrollable, and data must be processed through the platform.

Data Sent to the API and the Cost Accounting

The most thought-provoking part of the disassembly notes is the data flow. The extension sending browsing history to the Claude API is a prerequisite for the feature, but it means the right to handle sensitive information shifts from the user side to the server side. Browsing history reflects far more than "what sites you visited"—it hints at health status, financial situation, political leanings, and personal relationships.

On the cost side, the project offers a cost claim, but looking at the billing structure of Managed Agents, the cost of such "once-daily, context-carrying" sessions depends on two variables: the amount of history data submitted each time, and the length of state maintained in the session. If the extension re-injects the full history every day, token consumption will grow linearly with usage time. The truly sustainable approach is to do incremental summarization on the client side, sending only the changed parts to the agent.

This point is especially important for anyone wanting to replicate this project: the lever for cost control is on the client side, not in the prompt.

Token cost is key to understanding the economics of such "once-daily + context-carrying" sessions. LLMs bill by input and output token counts, and each time browsing history is injected into a session, the history itself is repeatedly billed as input tokens. If the full amount is retransmitted daily, the input volume accumulates with the number of days of use, and the cost curve approaches linear growth; if deduplication, aggregation, or incremental summarization is done on the client first, submitting only "the day's new and desensitized features," the input volume can be maintained at a roughly constant level. Additionally, the length of state maintained in the session also affects cost—a long session means each turn must carry prior context, while a short session with cold starts has smaller input but may sacrifice continuity. Both levers are in the client's hands.

Security Gaps to Close Before Copying

The teardown explicitly lists several unresolved security gaps, which is also the most valuable part of this article.

Lack of granularity control for history data. If the extension does not implement domain whitelisting or sensitive site filtering, records from banks, healthcare, and private email will all enter the API.

Extension permission scope. Chrome extensions' history permission is coarse-grained; once granted, the extension can read all history. It is difficult for users to choose between "partial authorization" and "full authorization."

Where the API key is stored. If the key is packaged in the extension, anyone can extract it; the correct approach is to route through a developer-built relay service, but this introduces a new trusted party.

Injection risk in returned content. AI-generated homepage content is rendered on a privileged page, and if the agent output is not sanitized, there is theoretically an injection vector.

The common thread among these gaps is that they are not defects of Managed Agents itself, but design decisions that inevitably arise when integrating hosted agents into clients. Anthropic handles the agent's runtime, but data boundaries, permission models, and output security remain the developer's responsibility.

The permission model of browser extensions deserves a separate explanation. Chrome extensions declare permissions through manifest.json, and history is a coarse-grained permission for "reading all browsing history"; users can only grant or deny it wholesale at install time, with no way to grant partial authorization by domain, time range, or site category. This means that once an extension obtains this permission, it technically has the ability to read all of the user's history records; whether it really only reads "recently visited pages" depends entirely on the extension code's self-restraint. For extensions handling sensitive data, a safer approach is to minimize the scope of permission requests, filter on the client before uploading, or switch to more granular alternatives such as activeTab or user-initiated selection, rather than defaulting to requesting full history permission.

What the Hosted Agent Model Means for Individual Developers

The emergence of projects like ai-newtab shows that Managed Agents are lowering the development barrier for "agent applications" from "needing a backend team" to "a single front-end engineer can try it." This was hard to imagine a year ago—stateful agent loops, tool calling, and session persistence used to be the workload of building your own infrastructure.

But while the barrier is lowered, responsibility does not shift along with it. The hosted service solves "how to run," not "should it be sent," "to whom," and "how much." The teardown of ai-newtab happens to be a cautionary tale: where the architecture is most convenient, that's often where security is most likely to be neglected.

For developers wanting to try similar solutions, a more pragmatic path is: first do data minimization and desensitization on the client, upload only aggregated features rather than raw URL lists, and treat Managed Agents as a "generation layer" rather than a "data layer." This preserves the convenience of hosted agents while avoiding handing over the user's most sensitive data all at once.

One-line Summary

ai-newtab uses Claude hosted agents to turn browsing history into a daily new tab page, validating the architecture while exposing privacy and cost gaps.

Paragraph Summary

ai-newtab is an open-source project that uses a Chrome extension to drive Claude Managed Agents in generating a personalized new tab page. The loop has four stages: collection, submission, generation, and rendering. Its value lies in validating the feasibility of the hosted agent architecture in small-footprint client scenarios—developers do not need to build their own orchestration, state management, and tool-calling backend. But the cost is that user browsing history must leave the local device and enter a third-party API, shifting the right to handle sensitive information. The project's teardown notes also point out that the key to cost control is on the client side rather than in the prompt: retransmitting the full history daily causes token consumption to grow linearly, and only incremental summarization is sustainable. On the security side, four gaps remain: history granularity control, extension permission coarseness, API key storage, and injection risk in returned content. A lower barrier does not mean responsibility has shifted.