AI agent to fill out web forms on the Mac: in its own Safari window, with its own cursor

Short answer: Yes, an AI agent can fill out web forms for you: with a computer use tool it opens the page, reads the fields, types your data, picks dropdown values and dates, and stops before it submits if you tell it to. On the Mac, ShadowCursor lets Claude Code, Codex, Cursor or any MCP agent do this in a Safari window of its own, with its own cursor, keyboard and clipboard. For your own contact details Safari AutoFill is enough, and for the same form hundreds of times a script or the site's import is simpler.

When an agent is the right tool for a form

An agent pays off when the form is not the hard part, the data is. It can collect values from an email, a PDF, a spreadsheet or another website and put each one in the right field, even when the form changes between steps. For other cases there are simpler tools:

Situation	Simplest tool
Your own name, address or card on a checkout page	Safari AutoFill
The same form on a site you run, many times	A browser automation script (for example Playwright)
The site offers an API or a CSV import	The API or the import
One-off or varying forms with data from several sources	An AI agent with computer use
Forms that end in a payment, a legal declaration or an account change	Do the last step yourself

Safari AutoFill fills forms from your contact card and saved cards (Apple's guide). Playwright fills fields by selector in a script and repeats the same form reliably (Playwright docs). Both are free and faster than any agent for what they cover.

What the agent needs

The model only decides what to type. A computer use tool on your Mac has to do the clicking and typing, and that tool decides what happens on your screen:

Claude Desktop and Cowork: their built-in computer use keeps browsers view-only, so it reads pages but does not fill them in; for web work Anthropic points to Claude in Chrome (Claude Desktop docs).
Claude Code CLI: its built-in computer use hides your other apps while Claude works and restores them after the turn (Claude Code docs).
A computer use MCP server: works in the client you already use. The guide to computer use MCP servers explains what to check.

ShadowCursor is such an MCP server. The agent gets its own cursor, drawn in its color with a name tag, its own keyboard, its own clipboard and its own windows. In Safari it opens a window of its own instead of using your tabs, because a background tab cannot be seen or operated. Its keys arrive only in that window, and it keeps working while your windows cover it.

Example prompts

Be specific about where the data comes from, which page to use and where to stop:

Open https://example.com/contact in your own Safari window and fill out the
form with the details from the email "Event booking" in Mail. Do not submit;
tell me when it is ready and list what you entered.

Register the five participants in participants.csv on the conference page
that is open in Safari. Use one registration per row, stop before the payment
step each time and show me the summary page.

Fill out the warranty claim on the manufacturer's site with the serial number
and purchase date from ~/Documents/receipt.pdf. Leave the comment field empty.

The last line of each prompt matters most. "Do not submit" and "stop before payment" turn the agent into a helper that prepares and you into the one who decides.

What happens step by step

The agent opens its own Safari window and loads the page. You see its cursor move there; your own windows stay where they are.
It reads the form. Every action returns a screenshot of that window plus its accessibility elements, so the agent knows the labels, fields, checkboxes and buttons.
It collects the data from the source you named: the email in Mail, a file on disk, another page.
It fills the fields. It sets text fields, chooses dropdown values, ticks checkboxes and works date pickers. Pointer and typing follow human timing, at about 200 words per minute with a human rhythm, so hover menus, sliders and date pickers react as they do to a person.
It checks the result on the next screenshot, fixes validation errors such as a wrong date format, and moves to the next step of the form.
It stops where you told it to and reports what it entered.

If you start typing in Safari yourself while the agent is working there, it waits for your pauses; your keys never reach its window.

Pitfalls and how to handle them

Logins

Sign in yourself before you start. A new Safari window in the same profile normally shares your signed-in sessions, so the agent can continue where you are logged in without ever seeing a password. Do not paste passwords into your prompt, and keep your password manager locked. If a site should not see your main accounts, use a separate browser profile. The guide on whether it is safe to let AI control your Mac covers this in detail, including prompt injection from text on the page.

Captchas and bot checks

A captcha exists to stop automation, and many sites forbid automated use in their terms. Do not plan a workflow around an agent getting past one. Tell the agent to stop and ask you when a verification appears, then solve it yourself in the agent's window and let it continue.

Autocorrect

macOS and some sites correct words as they are typed, which can change names and product codes. ShadowCursor detects such changes and retypes the word. Still ask the agent to list what it entered, and check names, IBANs and order numbers before submitting.

File uploads

Dragging a file from Finder onto an upload area is a system drag that follows the real mouse; ShadowCursor cancels such drags instead of dropping. Tell the agent to use the page's "Choose file" button and give it the exact path of the file, for example ~/Documents/receipt.pdf.

Hover and the browser

Hover without a click reaches pages in Safari, not in Chrome or Electron apps. Menus that open on hover therefore work best in Safari. The agent also needs its window on screen somewhere: minimized and hidden windows cannot be seen or operated, covered windows can.

Long forms and timeouts

Some forms log you out after a few minutes. Give the agent all data up front, in a file or in the prompt, so it does not stop midway to ask.

Several forms at once

Every agent gets its own cursor, keyboard and clipboard, so two agents can fill two different forms in two Safari windows at the same time without mixing up their input. The guide to running several AI agents at once shows a practical setup.

FAQ

Can AI fill out forms for me?

Yes, with a computer use tool that can type into a browser. The agent reads the page, fills the fields from the data you point it to and can stop before submitting. For your own address and card details, Safari AutoFill is already enough.

Can the agent get past captchas?

Do not count on it. Captchas are meant to block automation and sites may forbid it. Let the agent stop at a verification and solve it yourself.

Does the agent need my passwords?

No. Sign in yourself first; the agent's Safari window then usually shares that session. Never put passwords in a prompt.

Can it upload files to a form?

Not by drag and drop: dragging a file from Finder onto the page is a system drag, and ShadowCursor cancels those. Tell the agent to use the page's file button instead and give it the exact path of the file.

Which browser works best?

Safari. Hover menus react to the agent's pointer there, and the agent works in a Safari window of its own. In Chrome and Electron apps, hover effects respond only to the real mouse.

What does ShadowCursor cost?

There is a 7-day free trial without a card. After that it costs $12.99 per month or $69.99 per year, with unlimited agents on up to three devices. It needs macOS 15 Sequoia or later.