Open browser-agent research
Inspecting and reproducing the full model, data, training and evaluation pipeline.
Independent tool overview
MolmoWeb at a glance
MolmoWeb is Ai2's open visual browser-agent family. Given a task and a screenshot, its 4B or 8B model predicts browser actions such as navigating, clicking, typing, scrolling and switching tabs without depending on a site's HTML or accessibility tree. Ai2 released the Apache-2.0 weights, training data, inference client, training code, annotation tooling and six-benchmark evaluation harness, making MolmoWeb unusually inspectable and customizable. It is a research and self-hosting foundation, not a turnkey consumer browser assistant: the public demo is allowlisted and blocks password and credit-card fields, while those protections are explicitly not built into the model. MolmoWeb was not trained for logins or financial transactions, can misread screenshots or lose track after a bad action, and its benchmark completion rates are well below certainty. Production deployments need sandboxed browsers, restricted domains and permissions, step limits, audit logs, prompt-injection defenses and explicit human confirmation before any external message, purchase, account change, upload or other consequential action.
Visit the official MolmoWeb site ↗
- Developer
- Ai2 / Allen Institute for AI
- Product type
- Open visual web agent
- Release
- March 24, 2026; full code released April 10
- Model sizes
- 4B and 8B families
- Perception
- Browser screenshots and action history
- Actions
- Navigate, click, type, scroll, tabs and respond
- License
- Apache 2.0 model and repository
- Deployment
- Self-hosted local or cloud inference
- Login/payment training
- Explicitly excluded
- Demo safeguards
- Allowlist plus unsafe-query and sensitive-field blocks
- Reviewed
- August 31, 2026
Overview
What MolmoWeb is
MolmoWeb is an open multimodal web agent built by Ai2 on the Molmo 2 vision-language family. It translates a natural-language task and live browser screenshots into mouse-and-keyboard-style actions.
The agent follows a repeated loop: inspect the current screenshot and recent action history, produce a short reasoning trace, choose the next action, execute it and observe the new page state.
Supported actions include opening URLs, clicking normalized screen coordinates, typing into fields, scrolling, opening or switching tabs and returning a message to the user.
Unlike browser agents centered on the DOM or accessibility tree, MolmoWeb can operate from the same visual layout a person sees. That can reduce input size and work across sites whose underlying markup differs, but it makes text recognition and precise interaction dependent on screenshots.
The release includes nominal 4B and 8B agent variants. Ai2 publishes model weights, the MolmoWebMix datasets, training and inference code, an annotation extension, a synthetic-data pipeline and evaluation tooling.
The dataset combines human demonstrations with synthetic grounding, question-answering, trajectories and atomic skills. Ai2 says the agent trajectories were generated by text-only accessibility-tree agents rather than distilled from proprietary visual agents.
Ai2 reports strong results among open-weight browser agents, including 78.2% on WebVoyager for one 8B rollout. Those are research benchmark results scored by a VLM judge, not a production success guarantee; other reported benchmarks are substantially lower.
Running four independent attempts and selecting the best improves pass@4, but also multiplies compute and does not solve the problem of choosing a safe correct run when the ground truth is unknown.
Known limitations include screenshot text errors, premature scrolling, ambiguity, long constraint lists, element-specific scrolling and drag-and-drop. The model was not trained for tasks requiring logins or financial transactions.
The hosted demo's allowlist, unsafe-query filter and password or credit-card field blocks are wrapper safeguards, not capabilities embedded in downloaded weights. A self-hosted deployment must recreate and extend them.
Web pages can contain malicious or misleading instructions aimed at an agent. Treat all page content, downloads and tool outputs as untrusted, and keep browser credentials and internal networks out of reach unless a narrowly approved task requires them.
MolmoWeb is best viewed as an open research foundation for teams capable of building the browser sandbox, policy engine, confirmations, logging and evaluation layer around it.
Use cases
Who MolmoWeb is best for
The strongest fit depends on the job you need the product to complete, not the size of its feature list.
Narrow internal navigation
Automating low-risk, reversible tasks on a small allowlist of known sites in a sandbox.
Custom agent fine-tuning
Collecting approved demonstrations and adapting the model to one stable application or workflow.
Visual grounding experiments
Studying how screenshot-only agents locate and interact with interface elements.
Agent evaluation
Running built-in browser benchmarks or a custom task suite with inspectable trajectories.
Capabilities
Core MolmoWeb features
Screenshot-driven control
Navigates from rendered pixels rather than requiring a website API, DOM schema or accessibility tree.
Coordinate clicking
Predicts normalized click locations that the browser client converts into pixel actions.
Multi-step action loop
Uses the task, current page and recent history to continue through multi-page workflows.
4B and 8B variants
Provides two model scales for teams balancing compute cost, latency and research performance.
Open inference client
Includes local checkpoint and HTTP-oriented backends plus trajectory visualization.
Training pipeline
Releases supervised fine-tuning code on Molmo 2 checkpoints and scripts for downloading the training mixture.
Demonstration collection
Provides annotation tooling to record human tasks and screenshots for domain adaptation.
Evaluation harness
Supports WebVoyager, Online Mind2Web, Odysseys, DeepShop, WebTailBench and custom tasks.
Transparent trajectories
Makes the reasoning and action trace inspectable so developers can diagnose failure steps.
Process
How the MolmoWeb workflow works
Step 1
Choose a reversible task
Start with read-only lookup or navigation on public information, not login, payment, messaging, deletion or account administration.
Step 2
Build a domain allowlist
Permit only the exact hosts required and block localhost, cloud metadata, private networks, file URLs and unapproved redirects.
Step 3
Use an isolated browser
Run a disposable profile with no personal cookies, saved passwords, extensions, filesystem access or standing authentication.
Step 4
Constrain the action space
Set step, time, tab, download and navigation limits; deny sensitive field types and unsupported browser actions.
Step 5
Treat pages as untrusted
Do not let text on a website override the user's task, reveal secrets, install software or expand the agent's permissions.
Step 6
Create confirmation gates
Pause before typing personal data, submitting a form, sending a message, uploading a file, accepting terms or making any purchase or account change.
Step 7
Test representative layouts
Include popups, cookie banners, slow loads, small text, responsive pages, inaccessible controls, localization and adversarial instructions.
Step 8
Inspect complete traces
Save screenshots, planned actions, actual events, model version and final state while redacting secrets and personal data.
Step 9
Use an independent verifier
Confirm the final page state and extracted facts separately rather than allowing the same agent to grade its own work.
Step 10
Fail closed
Stop on uncertainty, unexpected redirects, authentication, CAPTCHAs, sensitive fields, downloads or any action outside the approved policy.
Cost
MolmoWeb pricing and free plan
MolmoWeb is an open research release rather than a paid hosted product. The 4B and 8B weights, repository, datasets and evaluation tooling can be downloaded under their published terms without a model subscription fee. The public demo is a constrained evaluation environment, not a production service, and Ai2 does not publish a paid plan, durable allowance or SLA for it. Self-hosted users pay for GPU compute, browser infrastructure, storage, observability, security engineering and ongoing maintenance. The Hugging Face 8B card did not list a deployed inference provider at review time. Pricing and availability were checked August 31, 2026.
Hosted demo
Free constrained evaluation
Ai2's safeguarded preview for watching MolmoWeb navigate allowlisted sites.
- Not a production service
- Website allowlist applies
- Password and credit-card fields are blocked
- No public SLA or fixed allowance
Open release
No model subscription fee
Download model weights, code, training data and evaluation resources.
- 4B and 8B model families
- Apache 2.0 model and repository
- Review each dataset and dependency license
- Intended for research and education under Ai2 guidelines
Self-hosted inference
Variable compute and operations cost
Operate the model server, browser workers and safety layer locally or in a cloud account.
- GPU requirements vary by model and concurrency
- Browser sandboxing and logging are separate systems
- vLLM is not an officially equivalent backend for exact model behavior
- Multiple rollouts multiply cost
Custom training
Variable multi-GPU cost
Fine-tune from MolmoWeb pretrained checkpoints using released training and annotation tools.
- Reference script defaults to 8 GPUs
- Requires curated demonstrations and evaluation data
- Adds data-governance, licensing and safety obligations
Pricing checked . Check current pricing at the source ↗
Assessment
MolmoWeb strengths and limitations
Where it stands out
- Publishes weights, data, training code, inference code and evaluation tools rather than only a hosted endpoint.
- Operates from screenshots, so it does not require a custom integration for every supported site.
- Visible action traces make individual failures easier to inspect.
- Two model scales give researchers an efficiency and performance tradeoff.
- Human and synthetic training resources support reproducibility and domain adaptation.
- The built-in benchmark harness encourages comparison on more than one curated test.
- Self-hosting can provide tighter control over model and browser infrastructure.
- The official release documents known limitations and distinguishes demo safeguards from the model.
What to consider
- MolmoWeb is a developer research foundation, not a polished consumer automation service.
- It can misread screenshot text, click the wrong coordinates and fail to recover from an early mistake.
- Ambiguous instructions and many simultaneous constraints reduce performance.
- Drag-and-drop and scrolling inside a specific element remain difficult.
- The model was not trained for login flows or financial transactions.
- Demo protections are not embedded in the downloadable model and disappear unless implementers recreate them.
- A 78.2% reported WebVoyager score still implies many failures, and some other benchmark scores are below 50%.
- Benchmark outcomes use automated VLM judging and may not reflect production correctness or safety.
- Repeated rollouts improve pass-at-k statistics but increase compute and require a trustworthy selector.
- Screenshot-only perception may struggle with tiny text, dynamic content, overlays, inaccessible widgets and responsive layouts.
- Web prompt injection, malicious downloads, redirects and data-exfiltration attempts require an external policy and sandbox layer.
- Open weights do not include identity, secrets, permissions, compliance, monitoring or incident-response infrastructure.
- Automating a website may violate its terms, robots rules, rate limits or applicable law even if the model can technically operate it.
- The repository cautions that vLLM may not reproduce the exact attention backend and can reduce accuracy.
Compare
MolmoWeb alternatives
The right alternative depends on the specific output, workflow, controls and budget your project requires.
Agents
Gemini Computer Use
Better when a developer prefers Google's managed computer-use model API over self-hosting an open visual agent.
Explore Gemini Computer Use →Agents
Comet
Better for end users who want an AI-first browser experience rather than an open model and research stack.
Explore Comet →Agents
Manus
Better for users seeking a hosted general-purpose agent that can research and produce artifacts without operating model infrastructure.
Explore Manus →Coding
Molmo by Ai2
Better for general image and video understanding, pointing and research without autonomous browser actions.
Explore Molmo by Ai2 →Questions
MolmoWeb FAQs
What is MolmoWeb?
MolmoWeb is Ai2's open visual web-agent family. It observes browser screenshots and predicts actions such as navigation, clicks, typing, scrolling and tab switching.
Is MolmoWeb open source?
Ai2 publishes the Apache-2.0 repository and model weights plus training datasets, pretrained checkpoints, an inference client, annotation tooling and benchmark code. Check each dataset and dependency license separately.
Is MolmoWeb free?
There is no model subscription fee for the open release and Ai2 provides a constrained demo. Self-hosting, browser workers, GPUs, storage, monitoring and security still cost money.
What is the difference between MolmoWeb 4B and 8B?
They are different model scales. The smaller family targets efficiency, while Ai2's reported benchmark leaders generally use 8B. Test both on your exact pages and hardware.
Does MolmoWeb use the DOM?
The agent's core design operates from screenshots rather than HTML or an accessibility tree, although the released client can also extract an accessibility tree for development workflows.
Can MolmoWeb log into my accounts?
Ai2 says the model was not trained on tasks requiring logins. Do not give it standing credentials; any approved authenticated prototype needs an isolated profile, minimum privileges and human confirmation.
Can MolmoWeb make purchases?
It should not do so autonomously. The training excluded financial transactions and the official demo blocks credit-card fields. Require a person to review the exact item, merchant, price, recurring terms and final submission.
Are the demo safety controls included in the model?
No. Ai2 explicitly says the allowlist, unsafe-query filtering and sensitive-field blocks are specific to the hosted demo, not built into the downloadable model.
How reliable is MolmoWeb?
Ai2 reports strong open-agent benchmarks, including 78.2% WebVoyager success for one 8B rollout, but other results are lower and benchmark judging is automated. Treat every live task as fallible.
How should MolmoWeb be deployed safely?
Use a disposable sandboxed browser, strict domain and network allowlists, no saved secrets, action and time limits, prompt-injection defenses, audited traces and human confirmation before consequential actions.
Can I fine-tune MolmoWeb?
Yes. Ai2 released training code, pretrained checkpoints and demonstration-collection tooling. Fine-tuning still requires licensed data, adequate GPUs and a separate safety evaluation.
Bottom line
Our MolmoWeb verdict
MolmoWeb is most compelling as transparent infrastructure for browser-agent research. Its open weights, data, training pipeline, client and evaluations let teams inspect and change parts that managed computer-use APIs hide. That openness also exposes the real work: the model is not trained for logins or payments, can fail on ordinary visual interactions and does not carry the official demo's safeguards into a self-hosted deployment. Use it only inside a narrowly scoped, disposable browser with an independent policy layer and human confirmation. Teams wanting ready-to-use browsing assistance should choose a managed product; teams prepared to build and evaluate the entire safety envelope will find MolmoWeb unusually valuable.
Visit MolmoWeb website ↗Similar Agents Tools
View all Agents AI tools →
Dynamic Workers
Dynamic Workers - Cloudflare's isolate-based sandbox for running AI agent code at scale
Holo 3
Holo 3 - H Company's open-weight computer-use agent that navigates enterprise desktops with SOTA accuracy on 10B active params
NemoClaw
NemoClaw - Nvidia's open-source security and privacy layer for OpenClaw autonomous agents
Perplexity Personal Computer
Perplexity Personal Computer - Perplexity's local orchestrator working across your files, native apps, and the web
AI training for the future of work.
Get access to all our AI courses, hundreds of real-world AI use cases, live expert-led workshops, an exclusive network of AI early adopters, and more.
AI Courses
Get unlimited access to all of our current & upcoming industry-specific AI courses for the duration of your subscription.
Daily Guides
To keep up with the rapid pace of AI, our team publishes AI implementation guides daily. Our library contains 300+ practical use cases to automate real-world work.
Workshops
Join weekly, live, interactive sessions with industry leaders who are at the forefront of AI for hands-on implementation guidance and exclusive insights.
Community
Network with an exclusive community of AI-first professionals who are working smarter with AI. Learn how early adopters are using AI in their work and businesses.