Aloha, the Cyprus company behind the Aloha Browser, on September 22, 2026 released AlohaJet, a browser built to be driven by AI agents rather than people, claiming it uses 54% fewer tokens and runs web tasks 2.2 times faster than existing automation tools. Both figures come from the company's own benchmark, and they are measured against two different rivals.

In Short

Aloha made a web browser that AI programs, not people, are meant to operate, and it says the browser lets those programs finish online chores while burning far less of the paid text that AI companies bill by. That matters to any business paying for AI agents by usage, because the bill grows with every page an agent has to read, and to publishers whose websites those agents visit. The savings come from a test Aloha ran itself on small models, with the speed and cost claims each compared against a different tool, so they are a starting claim rather than a settled result.

What Aloha put on the market

AlohaJet arrived on September 22 from Aloha Mobile Ltd., the Limassol-based company whose privacy-focused Aloha Browser has, according to Aloha, served more than 300 million users. It is not a consumer browser with a chatbot attached, but a browser meant to be operated by software: a language model, supplied by the user, receives a task in plain language and the browser carries it out across websites and web applications, using 54% fewer tokens than standard Chrome automation, according to the company.

It runs headed, with a visible window a person can watch and take over mid-task, or headless, driven from a command line or through the Model Context Protocol, the open standard that now wires most language models to external tools. Any tool-calling model can drive it, according to Aloha, including open-source models running locally.

Availability is narrow. The desktop application runs on macOS only; Linux is listed as coming, without a date, and Windows is not mentioned. A free tier covers the full browser in both modes, the command-line tool, the MCP server and any model on the user's own API keys. Pro at $20 a month and Ultra at $200 a month carry no feature list yet. Enterprise deployments in a customer's virtual private cloud, on premises or fully air-gapped are offered on request, and Amazon Web Services and Nebius are listed as partners, without detail.

The 300 million figure is cumulative, not a count of current users. Cloudflare data for the second quarter of 2024 put Aloha Browser at 0.060% of global traffic and 0.154% on iOS, and in July 2025 it was one of three browsers each holding less than 0.2% of iOS traffic. For a small independent browser maker, AlohaJet is a bet on a different customer: the developer or enterprise running agents at volume.

Andrew Frost, Aloha's founder, put the problem in cost terms. "A few dollars for one automated task is easy to dismiss. Run that same task 10,000 times and suddenly you have a very real infrastructure bill," he said. "We ran into this problem ourselves at Aloha. Too much model capacity was being spent just figuring out what was on the page instead of completing the work. AlohaJet came out of trying to strip away that waste and make web automation faster, cheaper and more efficient at scale."

How LLMdex is supposed to work

The engine behind the claims is a component Aloha calls LLMdex. According to the company, it points the model at the relevant parts of a page and at the next action, rather than making it reinterpret raw page data or screenshots at every step, and for recurring workflows it reuses what it has learned instead of relying on fixed instructions that go stale when a site is redesigned.

The LLMdex product page describes three mechanisms. A ladder sends each request to the cheapest model judged able to handle it, so small open-source models take most steps and frontier models are rarely called. Replay turns the first run of a task into a route that later runs follow, with routes stored on the server so every connected agent benefits. And the routing decision sits in one place, so an improvement reaches every connected agent at once, with no release required on either side. Migration means changing one line - the base URL - for any agent that already speaks OpenAI's chat completions format. LLMdex is described as self-hosted, as is every model on the ladder if the customer chooses.

The page does not explain how a replayed route is checked when a site changes, which is the failure that breaks the fixed scripts Aloha criticises. Nor does it say how routes learned by one agent are kept from carrying one customer's data into another's workflow. And instant, centrally pushed routing improvements sit awkwardly with an air-gapped installation that is supposed to have no outside connection. The product site offers no technical paper on LLMdex, and none of the repositories on Aloha's GitHub organisation page carries the name.

What the open-source code shows

What is public is a command-line tool. The repository, alohajet-cli, is licensed under Apache 2.0 and written in Swift, and on September 26 it stood at version 0.4.4, with 34 commits and 19 stars. It requires macOS 14 or later; Linux builds are tested, but the README states that every measurement in it was taken on macOS. The tool attaches to a Chromium browser over the Chrome DevTools Protocol.

The design explains part of the token story: the tool exposes nine functions to a model, against roughly 57 in Google's chrome-devtools-mcp server, the baseline Aloha benchmarked against. Tool definitions travel with every request and are billed as input, so a shorter menu costs less before any page is read. Pages come back as markdown, with each clickable element tagged by a reference hashed from its developer-assigned ID, or from its position when no ID exists. Because the label is computed rather than assigned per snapshot, it stays the same across separate processes and even different browsers. Two batch functions let a model fill up to 20 form fields, or read up to 20 elements, in one call.

The README is candid about limits. References change when an unnamed element moves, for instance when a sibling is inserted above it. There is no coordinate clicking, so canvas games, WebGL viewports, map widgets and PDFs in the browser's viewer cannot be reached, and there is no console access, network inspection or data extraction function.

So what exactly is open? The command that hands a plain-language prompt to an agent does not ship in the repository; it forwards the request to the Aloha browser's own automation server on the local machine. The open code is the plumbing a model uses to click and type, while the agent loop and LLMdex live in the application. The product site calls both the browser and the command-line tool open source, and Aloha's GitHub organisation does host aloha-core, a Chromium fork described as the browser's web engine, last updated on July 29, 2026.

Reading the benchmark

All numbers on Aloha's benchmark page come from WebArena, pooled across runs with OpenAI's GPT-5-mini and Alibaba's Qwen3-30B, with ten repetitions per task. Three configurations were compared: AlohaJet, Google's Chrome DevTools MCP and Microsoft's Playwright MCP.

MetricAlohaJetChrome DevTools MCPPlaywright MCP
Task success rate88%51%11%
Average time per task39 seconds73 seconds84 seconds
Average tokens per task158,000340,000not reported

WebArena is an academic test. Carnegie Mellon University researchers published it in July 2023 with 812 tasks spread across self-hosted copies of an online shop, a discussion forum, a GitLab code repository and a content management system. In the original paper, the best GPT-4 agent completed 14.41% of tasks end to end, against 78.24% for humans. Aloha has not said how many of the 812 tasks it ran, which sites they came from, or how success split between the two models.

The headline figures also rest on different comparisons. The 54% token reduction is measured against Chrome DevTools MCP: 158,000 against 340,000 tokens works out to 53.5%. The 2.2x speed figure is not. Dividing 84 seconds by 39 gives 2.15, which rounds to 2.2 - but 84 seconds is Playwright MCP's time. Against Chrome DevTools MCP, the speed advantage is 1.9x, yet the release places the 2.2x figure in the same sentence as its comparison with "standard Chrome automation".

The naming of rivals shifts too. The release refers to "standard Chrome automation" and to "Playwright, a widely used browser automation framework". The benchmark page names two MCP servers, the interfaces through which a model steers a browser. Playwright MCP's 11% describes how small models fared through that server, and says little about Playwright in its usual role running test scripts engineers write by hand.

Then there is scale. According to the release, six common web tasks, including search, form filling, data extraction and multi-page navigation, can require up to 94,000 tokens depending on the approach, and in AlohaJet's benchmark "the same workload used 54% fewer tokens". That implies about 43,000 tokens for six tasks, or roughly 7,200 per task. The benchmark page puts AlohaJet's own average at 158,000 tokens per task, around 22 times higher. The two figures must describe different workloads or different counting; Aloha has not reconciled them, nor said where the 94,000 figure comes from. The release also prices its argument with frontier models "costing up to $30 per million output tokens", while the benchmark ran on two small models priced at a fraction of that. No independent party has reproduced the results.

The arithmetic behind the pitch

Frost's 10,000-run example can be priced with the benchmark page's own averages. At 340,000 tokens a task, 10,000 runs consume 3.4 billion tokens; at 158,000, they consume 1.58 billion. If every one of those tokens were billed at the $30 per million ceiling the release cites, the bills would be $102,000 and $47,400.

That is a generous upper bound. Agent workloads are dominated by input, which providers price well below output, and OpenRouter data found cached prompts accounting for more than 85% of agentic token spend. At the cheap end, Google priced a Gemini Flash-Lite model at $0.30 per million input tokens in July 2026, which would put a 158,000-token task at under 5 cents and a 340,000-token task at about 10 cents. On small models the token saving is worth cents per task. The success rate matters more, because every failed task has to be run again.

The release's context statistics carry no sources. It says task-specific AI agents are expected in 40% of enterprise applications by the end of 2026, matching a Gartner forecast, and that more than 40% of agentic AI projects will be canceled by the end of 2027, which is Gartner's prediction of June 25, 2025. It also says agentic tasks can consume roughly 1,000 times more tokens than conventional AI interactions, and that 93% of organisations have exceeded their AI budgets while spending rose nearly fourfold; neither claim is attributed. OpenRouter data reported in August showed agents using close to five times as many tokens per task as humans - two orders of magnitude below the release's multiplier.

The cost pressure itself is well documented. KPMG found that 49% of senior leaders had narrowed, delayed or paused agent deployments when running costs outran value, with only 35% reporting fully visible AI costs. Agencies have begun building daily token caps and audit logs after one Dept employee consumed 1.5 million tokens in a day, and Draft Digital collapsed twelve MCP calls into one buyer agent to contain the same burn. Compact page representation is not new either: Cloudflare's Markdown for Agents cut one blog post from 16,180 tokens in HTML to 3,150 in markdown in February 2026, from the publisher's side.

Privacy claims and what the code does not defend

The release's privacy argument concerns where data goes. According to Aloha, sensitive steps or whole workflows can run through self-hosted models, and when AlohaJet is configured entirely inside a customer's environment, browser sessions, credentials and prompts can stay within the company's network. That addresses one exposure: page content and logins travelling to a model provider.

It does not address what a page can tell the agent. The command-line tool's README lists its protections - non-web URL schemes refused, password fields masked, network logging off by default - and its absences just as plainly. There is no host allow-list, no sandbox and no detection of prompt injection. Page text is wrapped in a fenced block with a fresh key on every read, which the README calls a delimiter rather than a defence. The DevTools debugging port has no authentication, so any process running as the same user can connect. Internal addresses, including the cloud metadata endpoint at 169.254.169.254, are accepted as valid destinations - relevant for headless fleets inside a corporate cloud. A guard against typing into credential fields exists but is off by default.

The risk is not theoretical. Brave's security team demonstrated hidden instructions steering Perplexity's Comet into actions such as retrieving one-time passwords, beginning in August 2025. A benchmark from Meta's FAIR group, cited in coverage of Chrome auto browse, found low-effort human-written injections partially succeeding in up to 86% of realistic cases. Google's July post on that feature offered only a general assurance about recognising known threats. Aloha's README at least lists what it does not defend against.

Why advertisers and publishers are watching agent browsers

For publishers, the first question is identification. AlohaJet's default headless Chromium identifies itself as HeadlessChrome in its user agent string, so sites filtering on that label will refuse it - but the README documents a setting that overrides the string. It makes no mention of signed agent identity of the kind Google referenced when it added Google-Agent to its crawler list in March 2026. HUMAN Security's May 2026 data showed blocking rates for agentic traffic climbing toward 9%. Cheaper agents mean more of that traffic, whatever label it carries.

The legal position has shifted as well. On August 4, 2026, the Ninth Circuit vacated the injunction that kept Comet out of Amazon accounts, holding that the user, not the agent's maker, is the party accessing a site when the agent runs on the user's own machine. AlohaJet runs on the user's device by default. Whether that reasoning covers headless fleets inside a company's cloud was not before the court.

The consumer side of the category has been volatile. OpenAI discontinued its Atlas browser on July 9, 2026, less than nine months after its debut. Google connected Gemini Spark to Chrome on July 30 while keeping it out of the EEA and the UK, and Meta's Muse, published on September 8, runs its own browser on its own virtual machine. Each was built around its maker's own models. AlohaJet sells the layer underneath, a browser for agents others build, and competes with tooling Google presented as Chrome DevTools for agents at I/O on May 19, 2026.

Concentration is the last thread. France's competition authority found that OpenAI, Google and Anthropic held more than 84% of the global AI agent market in May 2026. A browser benchmarked partly on Qwen3-30B, an open-weight model, sits outside that triangle. LLMdex, however, places the routing decision - which model answers, which route is replayed - inside a layer Aloha designs and updates centrally. Trading one dependency for another is still a dependency. Until the task counts, per-model results and the source of the 94,000-token figure are published, the benchmark remains Aloha's case for AlohaJet rather than evidence others can check.

Timeline

Summary

Who: Aloha Mobile Ltd., the Limassol, Cyprus, maker of the Aloha Browser, through founder Andrew Frost. The product is aimed at developers and enterprises running AI agents on the web, and it affects the advertisers, agencies and publishers whose sites and budgets those agents touch.

What: AlohaJet, a Chromium-based browser designed to be driven by AI agents in headed or headless mode through a command line or the Model Context Protocol. Aloha claims 54% fewer tokens, 2.2x faster execution and an 88% task success rate on WebArena, pooled across GPT-5-mini and Qwen3-30B. The token figure is measured against Chrome DevTools MCP and the speed figure against Playwright MCP; against Chrome DevTools MCP the speed gain is 1.9x. A release figure of 94,000 tokens for six tasks conflicts with the benchmark page's average of 158,000 tokens per task for AlohaJet itself. The command-line tool is open source under Apache 2.0; the LLMdex routing layer has no public repository.

When: Released on September 22, 2026. The public repository stood at version 0.4.4 on September 26, 2026. Linux support has no date, and the $20 and $200 monthly tiers have no published feature lists.

Where: The desktop application runs on macOS only. Enterprise deployment is offered in customer clouds, on premises or air-gapped. The benchmark ran on WebArena's self-hosted test sites.

Why: Token costs have become a line item in agentic deployments, with KPMG finding 49% of leaders cutting back when costs outran value and agencies building daily caps. Aloha argues that a browser giving models a compact view of each page, and routing routine steps to cheap models, reduces that bill. The benchmark is vendor-run, incompletely disclosed and mixes baselines, and the code's own documentation lists no prompt injection defence.