I Pointed an AI Browser Agent at Real Job Applications

A live job application form I opened this week had nine form controls in it. An AI browser agent can type into seven. The eighth wants a file off your hard drive, and the ninth isn't meant for you at all: it belongs to the bot check.

This is for anyone who has seen the ads promising an agent that applies to a thousand jobs while you sleep and wants to know what happens when you aim one at a real employer's form. By the end you'll know which half of an application an agent genuinely handles, where it hits a wall no prompt gets you past, and what the people receiving all of this are seeing on their side.

One thing up front, because it changes how you should read the rest. I did not let an agent submit a single application, and I did not create a candidate account to test one. I opened live application forms and read them the way an agent reads them, checked what these tools are documented to do and refuse to do, and pulled the numbers from the receiving end. No real employer got a robot application out of this article.

What I wanted to hand over, and what I kept

I wanted the agent to take the repetitive part of an application and leave me every step that carries my name. That repetitive part is real work: read the posting, rewrite my summary in the language the posting uses, answer the screening questions, and log the whole thing somewhere I can find it again in three weeks.

The part I wanted to keep was small and specific. Attaching the file. Logging in. Clicking submit.

It's the same line I drew when I handed a browser agent a day of ordinary errands, where the agent did all the finding and I did all the finishing. What I wanted to know this time was whether a job application even lets you split it that way, or whether the two halves are welded together.

The plan: read a job application the way a browser agent reads it

A browser agent doesn't see the page you see, so I stopped guessing and had it list the actual form controls. That list is the agent's whole world on a page: field types, names, and what each one accepts.

I opened a live Greenhouse-hosted application page on July 28, 2026. Greenhouse is an applicant tracking system, the software that receives and sorts applications behind a company's career page. Here's what came back.

9 form controls: 6 text, 1 tel, 1 file, 1 textarea
file input:  name="resume", accept=".pdf,.doc,.docx,.txt,.rtf"
textarea:    name="g-recaptcha-response" (hidden, belongs to the bot check)
resume row:  Attach | Dropbox | Google Drive | Enter manually
reCAPTCHA script + iframe: already loaded on page load

Six plain text boxes and a phone field the agent can type into. One file input, and that one turned out to depend entirely on how you drive the agent. And one hidden box that isn't a question at all, waiting for a bot check that had loaded before I typed a single character.

What it's weirdly good at: everything made of text

Every part of an application that is only words is the part an agent handles well, and that's more of the form than the ads let on. It reads the posting end to end, picks up the exact phrasing a team uses for its own role, and rewrites your summary to match without inventing a job you never had, as long as you feed it your real history and tell it not to embellish.

Then I found the detail that made the picture click. Clicking "Enter manually" on that resume row added a tenth control to the page: a visible textarea with the id resume_text, where you paste your resume as plain text instead of attaching it. One field, two lanes, and the text lane is the one no tooling gap can close.

Here's the prompt I'd actually use for the text half.

Read this job posting and my resume text. Rewrite my summary and my three most relevant bullets using the exact vocabulary the posting uses, without adding any employer, title, date, or number that isn't already in my resume. Then draft an answer to the application's free-text question in under 150 words. Output text only. Do not upload anything, do not log in anywhere, and do not submit the form.

Where it went wrong: the handover, not the writing

The handover is where it went wrong, and not for the reason I expected: the file turned out to be the softest of the three barriers. Anthropic's own support page for Claude in Chrome lists image uploads as a feature and names a form attachment as an example, so the extension itself can drop a file into a file input. What breaks is the plumbing around it: in a March 5, 2026 issue on Anthropic's repo, a developer showed the same extension hands Claude Code seventeen tools over its connection and file_upload is not one of them. That leaves an agent driven from the terminal with upload_image, and that only accepts an image captured in the session, not a path on your disk.

Encoding the file as base64 text instead hits a different ceiling: a 150KB file blows past the practical token limit and takes five or more calls to move.

The issue was closed as a duplicate, which is what you call a gap somebody plans to close.

So I went and looked at the other big system. Workday's apply screen offered exactly three routes: Autofill with Resume, Apply Manually, and Use My Last Application. The first wants a file. The other two want a candidate account with a password, and Workday accounts don't travel, since the one you created for company A does nothing at company B.

Then there's that reCAPTCHA. Anthropic's usage policy forbids using Claude for anything that circumvents "the guardrails or terms of other platforms or services", which covers a bot check better than any product page does. Every serious agent draws that same line, and a tool that advertises its way around it is telling you exactly what kind of tool it is.

The part I didn't expect: the rule was already written

The platforms didn't wait for this to become a debate, because the clause has been sitting in the terms for years. The LinkedIn User Agreement, section 8.2, tells users not to "use bots or other unauthorized automated methods to access the Services". That covers the auto-apply extension in exactly the same breath as the scrapers.

There's a workable middle, and it's the one most compliant tools have settled on: AI drafts, you read it, you click send. It's the same discipline that matters whenever you give an agent access to your accounts, which I looked at from a different angle when an AI agent got a week with a calendar and inbox.

The result: the numbers on the other side of the form

Even if every one of those barriers disappeared tomorrow, the math on automated applying is bad and getting worse. Greenhouse CEO Daniel Chait told Fortune on July 27, 2026 that applications per recruiter on the platform are up 412% since 2023, that its roughly 175,000 live jobs draw an average of about 254 applicants each, and that candidates are buying $20 tools to fire at every listing. He calls the result an "AI doom loop": everyone solving their own problem with AI and making the system worse for everybody.

The candidate-side numbers agree. One person documented running 819 AI-submitted applications in a single month for about $50 and two days of setup. It produced 71 responses and 5 interviews, an interview rate near 0.6%.

Let's do the math from where you're sitting. Those 819 applications bought five interviews, and the write-up thins that number itself: two were at companies the writer turned down on the spot and one role changed shape mid-conversation, which left two companies still talking. They also cost every hour spent babysitting the bot plus your name on 819 forms you never read.

A hundred applications you wrote and checked yourself, at a 5% hit rate, buys the same five, and none of them are companies you'd have declined at hello. The subscription is real money too, and it stacks up quietly beside every other AI bill you already pay, which is worth checking against what AI actually costs you per month.

I've sat on the receiving side of a posting. At 254 applicants nobody reads carefully. They scan for a reason to stop reading, and a generic AI-shaped application is the easiest reason there is.

Would I do it this way again?

Yes, with the split exactly where I found it. A browser agent is a strong drafting partner for job applications and a poor submitter, and that second half is not mainly a technical gap. The login and the bot check exist precisely to make sure a person is on the other end, and the terms you agreed to say that person is you. When a tool promises to get around both for $20 a month, the thing it's automating away is the part that made your application yours.

Bottom line: let the agent write it, and be the one who sends it.

At a glance