Composio's premium tool billing goes live on September 10, 2026, for every customer, including those who joined before August 15. If your application runs browser automation through Composio, that's the date the task meter starts.
The grandfathered plan rates hold through December 31. The browser task charges do not wait. Those begin September 10 regardless of your original signup date or current tier.
The cost cliff
Composio prices browser automation at approximately $0.70 per task (the Browser Use integration rate on composio.dev/pricing as of September 2026).
At low volume the math is uncomfortable. At higher volumes, it changes the unit economics of anything you have built on top of it.
Teams that have been paying a flat monthly subscription for Composio's catalog access are now looking at $0.70 per task on top of their existing plan fee. At 1,000 tasks per month, that is $700 in task charges before the plan cost is counted. Most teams running meaningful browser automation are well above that volume.
Developers evaluating alternatives have described the shift in terms that go beyond sticker shock. One observation that circulated: going from catalog-access pricing to per-task metering at $0.70/call does not feel like a routine price adjustment. It feels like a different product at a different price point. Another: a team running the same 2-million-call workload goes from roughly $229 per month to somewhere in the $6,000-$8,000 range. That is not a rounding error that a roadmap conversation smooths over.
The math bears it out. A team running 2,000 browser tasks a month was effectively paying their base plan rate. Starting September 10, they pay that plus roughly $1,400 in task fees every month.
The credential-custody problem
The pricing change shows up on the next invoice. There is a second issue that predates September 10 and matters more for teams handling real customer data.
By default, Composio holds your credentials. Using self-managed credentials, where your application stores and supplies its own OAuth tokens and API keys, requires the Business tier at $599 per month. Below that, your users' connected account credentials live in Composio's infrastructure.
In May 2026, that infrastructure was breached. Composio's own incident report describes 5,241 API keys and 5,001 GitHub OAuth tokens exfiltrated, along with tokens for Gmail, Slack, Jira, HubSpot, Linear, and Google Calendar. The attack started with a compromised employee OAuth token, which gave access to an internal agentic monitoring tool. That access was used to register malicious tool definitions in a sandbox environment, which executed code that reached the credential cache. Composio revoked the affected tokens and rotated keys company-wide. The affected connections represented approximately 0.3 percent of their total active connections at the time.
The remediation did not change the architecture. Centralizing credential custody means a future compromise, through a different employee account, a different internal tool, or a different execution path, carries the same blast radius. For teams on tiers below $599 per month, that architecture still applies. The option to remove Composio from the credential custody chain costs more per month than many teams' full infrastructure budgets.
Material Security's analysis of the breach noted that credential custody as a paid tier, rather than a default, makes security posture a function of plan level. For teams handling customer data with connected accounts (OAuth tokens to productivity tools, email access, calendar permissions), that is a structural risk, not an edge case.
How WebRun compares
WebRun prices browser automation at approximately $0.01 per task, with no separate metering layer. The Starter plan at $20 per month covers around 2,000 tasks; Pro at $100 per month runs around 11,000; Business at $200 per month around 24,000.
On credentials: WebRun does not hold them. Your application supplies credentials to each browser session at runtime. There is no central credential store, because the architecture does not require one. Your OAuth tokens and API keys stay in your own infrastructure, and access to them stays under your control.
For a team running 10,000 browser tasks a month, the comparison is roughly $100 with WebRun versus more than $7,000 with Composio starting September 10. The security question is a separate reason to look.
WebRun's browser task API covers the common Composio browser use cases (scraping, form automation, multi-step web workflows) without credential storage requirements or per-task pricing. September 10 is nine days out.
