Opportunities › LLM-controlled browser automation with security sandboxing › Proposed app
Cellwalk
Let any LLM drive a real browser in a locked sandbox, with egress rules and audit logs
- Score
- 62
- confidence 53
- Evidence
- 8
- items on the page
- Rivals
- 2
- named in sources
- First version
- 45 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2025
- New market · AI estimate
ScreensConcept
Desktop app: Engineers set up agents, review dense audit logs, manage allowlists and approval gates from a desk during development work. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Runs
All sandboxes healthy128
About this appAI proposal
Cellwalk lets your LLM agents use real web apps without handing them your network. Each task runs in a throwaway browser inside a process-isolated sandbox. You decide which sites it may reach, which secrets it may use and what it may send out.
It is built for software teams that put agents into production and must answer security review questions. Use the model provider you prefer, switch later, or mix several. Every click, page and request is recorded, so you can replay a run and show what the agent did.
A public Hacker News claim says most projects in this space treat sandboxing as less important than it should be. Cellwalk starts from isolation and adds browser control on top.
- Tagline
- Give agents a browser, not your network.
- Voice
- PreciseCalmDirect
- Why this name
- A cell is an isolated room; walk is what the agent does on the web. Two plain words joined: the agent walks the web from inside a cell.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Isolated browser per task
Every run gets a fresh browser in a sandboxed container with no shared state and no route to your internal network. It is destroyed when the task ends.
No member yet
Egress allowlists
Set which domains an agent may open and which it may never reach. Blocked requests are logged, so data cannot quietly leave.
No member yet
Bring any model
Use your own keys with several LLM providers and choose per task or per team. Your automations are not tied to one vendor.
No member yet
Scoped secret injection
Credentials are filled into pages by the sandbox, so the model never sees the raw password or token in its prompt.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#16382FDeep Moss · primary#F6F3EAPaper · surface#14201CInk · text#E8A33DSignal Amber · accent#B5412FBrick · blocked status#7FA38FSage · data
Typography
Aa
Cellwalk
PricingAI proposal
The material gives no competitor prices. These tiers, based on monthly execution volume as the opportunity suggests, are a starting point to test.
Trial
Free
- 50 task runs a month
- 1 sandbox at a time
- Basic audit log
- Your own model keys
Team
$99 a month
- 2,000 task runs a month
- 5 parallel sandboxes
- Egress allowlists
- Approval gates
- 30-day replay history
Business
$499 a month
- 20,000 task runs a month
- 25 parallel sandboxes
- Secret vault and SSO
- 1-year audit export
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- No loop in the product. Reached through developer content, security write-ups and direct sales to teams shipping agents. Replay links could be shared inside a team but do not reach new buyers by themselves.
- Do they become customers?
- Test whether security reviewers who open a shared replay or audit export ask to try it, and whether engineers convert from the free trial to Team.
- First customers
- Engineering leads at small software companies of 10 to 100 people that run LLM agents against third-party web portals and face a customer security review.
- Where to reach them
- Hacker News: Publish a technical write-up on the sandbox design and the blocked-egress demo, and answer questions in the thread.
- Agent developer communities: Offer free trial seats in forums and chats where teams discuss agent security and browser tooling.
- Direct outreach: Message engineering leads who publicly ask about running agents safely, offering a guided setup.
- First milestone
- Five paying Team-tier customers in one vertical within 90 days of the first version.
Why people already pay for this
- EstimateBrowserbase: $67.5M total raised
- Public claimBrowser Use: $17M seed led by Felicis (March 2025)
- EstimateBrowserbase: $40M Series B at $300M post-money valuation (June 2025) (June 2025)
- EstimateBrowserbase: Free tier; paid plans $29, $49, $99/month; overage $0.10-$0.12 per browser-hour
- Public claimBrowser Use: 20+ companies in YC winter batch using it (March 2025)
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Sandbox runtimegVisor-isolated containers on a container hostPer-task process isolation for browsers needs a runtime beyond Vercel functions.
- This app · Browser controlHeadless Chromium with a controllable automation protocolAgents need a real browser they can click, type and screenshot.
RisksAI inference
- TechnicalBrowsers inside gVisor can be slow or break on some sites. Cold start time and per-task cost may hurt margins at the low-price tiers.
- CommercialEvidence is public claims only. Gobii already has paying customers per Hacker News, and OpenClaw competes, so the differentiation must be proved.
- AIPrompt injection from web pages can still steer an agent inside the allowed domains. Sandboxing limits the damage but does not remove it.
- PlatformSites may block cloud browsers or forbid automation in their terms, which could break customers' workflows.
- RegulatoryStored screenshots and traces may contain personal or regulated data, requiring retention controls and possibly compliance work buyers ask for.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.