Every capability, and what each one doesn’t do.

Every page you visit, every bookmark, and any local PDF you open is chunked, embedded, and written to an index on your disk. The agent retrieves from this index rather than from the open web, which is why it can answer “what did that contract say about termination” without a search engine ever seeing the question.

Indexing is incremental and runs in the background during idle periods, capped so it never competes with rendering. A typical article costs about 330 ms of background compute. Chunking is structure-aware: headings, tables, and code blocks are kept with the text that explains them.

Dart auto-detects Ollama, llama.cpp, LM Studio, and MLX on Apple silicon, enumerates the models each has available, and lets you assign one to the agent. Inference happens in that runtime, on your hardware. No prompt, no page content, and no result crosses the network.

The browser measures your machine at first run and recommends a configuration rather than presenting a list. On 16 GB of unified memory it selects a 7–9B model at Q4_K_M, which our benchmarks put at the knee of the quality/memory curve.

A task like “find the renewal date in this contract and add it to my calendar” decomposes into retrieval, extraction, and an action. The agent plans the chain, executes each step, and stops at any step that requires a capability you have not granted.

Every action is proposed before it runs. Navigation shows the full destination URL, and any part of that URL derived from page content rather than from you is visually marked — a direct result of finding that a confirmation covering the action but not its parameters approves exfiltration attempts.

Answers are assembled from retrieved passages, and each sentence carries a reference to the chunk that supports it. Clicking a citation opens the source at the right position, whether that is an open tab, a page from three weeks ago, or a local PDF.

Citation accuracy is the metric we gate model selection on, ahead of throughput. A model that produces fluent answers attributed to the wrong source is worse than a slower one that gets attribution right, and this is exactly what aggressive quantisation breaks first.

Every agent turn writes a record: which sources were retrieved, which were considered and discarded, which actions were proposed, and which you approved. The log lives on your disk in a readable format and is never transmitted.

The point is not compliance theatre. It is that when the agent produces a surprising answer, you can find out why in about ten seconds rather than guessing.

Capabilities are granted rather than detected. The agent cannot navigate, fill, submit, or download unless that capability is enabled, and grants are scoped to a domain or a session rather than granted globally.

Our injection research found that defences which work by detecting a malicious instruction can be defeated by rephrasing it, while defences that limit what the agent can do cannot. Capability gating was the single most effective defence layer we measured, and it is the one that degrades gracefully.

Identity keys are generated with the non-exportable attribute set, inside the platform security module — TPM 2.0 on Windows and Linux, the Secure Enclave on macOS. The key material is never present in system memory and cannot be read out by any software, including an administrator with full platform authorisation.

We tested this across 47 device models before shipping the claim. All 47 correctly refused every export approach we tried: direct export, null-parent duplication, administrative override, and blob extraction into a software TPM.

Every TLS session negotiates a hybrid construction combining classical X25519 with ML-KEM-768, the NIST-standardised lattice KEM. Hybrid means a break of either component alone does not compromise the session.

This is on by default rather than behind a flag because harvest-now-decrypt-later is a present-tense threat: traffic captured today can be decrypted later, and for anything with a long confidentiality lifetime the correct comparison is not milliseconds against zero.

Enrolment creates a site-scoped key inside the security module and registers its public half. Sign-in is a challenge signed by hardware. There is no shared secret, nothing to phish, and nothing in a breach dump.

Where the site supports it, Dart can additionally present a hardware attestation proving the key really is chip-resident. Where the device’s attestation chain does not validate, the key still works — it simply cannot prove its residency, and Dart tells you so rather than failing silently.

A non-exportable key is a liability if losing the device means losing the identity. Dart establishes a recovery path at enrolment, before the hardware key is trusted for anything, using threshold shares that you distribute rather than a custodial escrow we hold.

This is the part of the identity layer we are least finished with, and we would rather say so than imply it is solved. A preprint on the scheme is circulating for review.

Every site gets its own key, derived independently inside the security module. Two sites that collude cannot determine that they are talking to the same person by comparing credentials, because there is no shared identifier between them.

This extends to the browser’s storage partitioning: cookies, cache, and storage are partitioned by top-level site, so cross-site state cannot be used to rejoin what key isolation separated.

Add a key from Anthropic, OpenAI, Google, or OpenRouter and the agent uses it directly. The key is validated client-side and stored in your operating system keychain — not in a Dart account, not on our servers, and not in a synced profile.

Inference requests go from your browser to your provider. We are not in the path, we cannot see the traffic, and we do not add a margin. This is a permanent design choice rather than a launch limitation, and it is the reason our pricing does not depend on how much you use the agent.

If Ollama, llama.cpp, LM Studio, or MLX is running, Dart finds it and lists the models it serves. Selecting one makes the agent fully offline: no key, no account, no network.

This is the configuration regulated industries actually need, and the one we optimise hardest. It is also the reason our inference research focuses on consumer hardware rather than datacentre throughput.

An organisation can point every Dart install at a single internal gateway URL. Users sign in with SSO and never handle a key. The gateway can be a self-hosted model, a vendor endpoint, or a policy proxy that logs and filters.

This is how regulated deployments keep inference inside a network boundary a regulator drew, without asking every employee to manage credentials.

Out of the box, Dart contacts our servers for exactly two things: update checks and certificate revocation. There is no analytics endpoint, no usage reporting, no crash telemetry, and no advertising identifier, and there is no setting to change because there is nothing to switch off.

We measured the four major browsers over 30 days to establish what “default” normally means. At default settings they issued between 214 and 3,140 vendor-bound requests per day, and enabling every privacy setting eliminated this in none of them.

Canvas and WebGL readback are perturbed, font enumeration is restricted to a fixed set, and high-resolution timing is coarsened. Known tracker origins are blocked at the network layer before a request is made.

There are no user-facing anti-fingerprinting toggles, and that is deliberate. Our measurement work found that hardened configurations increase entropy in one attribute group by 19%, because turning off features almost nobody turns off makes you distinctive. Uniformity protects people; configurability does not.

If you turn sync on, what replicates is the structure of the semantic index — not URLs, not page text, not your agent conversations. A second device can find that a relevant document exists and where it came from, and re-fetches the content locally.

Sync is off by default. This is the one feature where we move any browsing-derived data off your machine, so it is opt-in, scoped, and documented in full rather than buried.

Dart tracks upstream Chromium closely and carries a patch set that removes Google service integrations: sync, safe-browsing-as-implemented, field trials, metrics, and the component updater’s telemetry surface. Rendering, V8, and the sandbox are untouched.

We publish the full patch inventory — every patch we carry, what it removes, and the web-compatibility cost of each — because “de-Googled” is a claim that means nothing without a list.

A profile bundles an identity set, a model selection, and a capability policy. Work and personal browsing can use different models, different keys, and different agent permissions without signing out of anything.

Per-domain rules sit inside a profile: you can grant the agent form-fill on your issue tracker and read-only everywhere else, and the rule follows the domain rather than the session.

Enterprise deployments can run a build with update checks and revocation disabled, a local model, and no configured gateway. In this configuration the browser makes no outbound connection except to the sites you visit.

Updates are managed out of band by the administrator, which is how these environments handle every other piece of software.