An RPA agent where the person who knows the task writes the automation in plain language, and the bot asks before it guesses
Anyone who has maintained RPA bots knows the two classic pains: a selector breaks as soon as the site changes, and every automation needs a developer to build and maintain it, far from the person who actually knows the task.
I've been building ANCHOR, a research project at my university in Brazil, to try a different split. The person who knows the task describes it in plain language ("Register Maria Silva, IT department, contractor, and save"), and the system runs it in the browser. It runs locally, with small open models through Ollama (Qwen 3.5, 4B and 9B) on a 4 GB GPU, so no data leaves the machine.
Who controls what
- The LLM only plans. It turns the request into steps, using the names of the elements on the page. It never clicks anything.
- A deterministic heuristic finds each element, and refuses when it isn't sure.
- Then the user decides: the candidates are numbered on the page, the user picks one, and the choice is remembered for the next runs.
What matters for day-to-day RPA (version 0.3)
- Saved automations: the task is learned once with the model, then replayed without it, in about 3 s per run, with parameters and one run per row of a spreadsheet.
- When the site changes, a saved automation recovers (by asking the user, or by replanning with the model when no one is there), keeps the fix, and records it: what failed, what replaced it, and how. Every recovery can be reviewed and undone.
- Sensitive actions ask first: deleting, saving, sending, paying, downloading, uploading, cancelling something irreversible. The decision is saved per automation.
- Each action's effect is checked (the page changed, the field kept the value, no error appeared), and the end of a run is checked against what was actually done, so a run that didn't do the task doesn't end as a success.
- Page content can't give orders: instructions hidden in pages are treated as data.
A benchmark against a classic script
30 tasks on pages altered in 5 levels (renamed IDs and classes, synonyms like "Save" becoming "Submit", restructured layouts, cookie banners and hidden sections, lookalike decoys and injected instructions), 150 runs per executor and model, with no user:
| Executor | Tasks done | False successes |
|---|---|---|
| Fixed-selector script | 53% | 0 |
| LLM in control (4B / 9B) | 68% / 72% | 33 / 41 |
| ANCHOR (4B / 9B) | 82% / 84% | 2 / 1 |
The script was perfect where labels changed (it doesn't read them) and failed where IDs and structure changed; the LLM in control often claimed success without doing the task. ANCHOR's weak spot is content hidden behind a "Show more" button. These are development numbers; a closed test set is waiting for the 1.0 run.
What's next: uploads, downloads, new tabs and data extraction (0.4), then a local interface with a "Run" button per saved automation (0.5).
I'd really value feedback from people who build and maintain bots: would you trust a bot that recovers on its own if every fix is recorded and undoable? What would you need to see before using something like this on a real process? And if you try it, failure cases on real sites are the most useful thing you can send me.
Repo (source-available, PolyForm Strict): https://github.com/LucasDantas2701/ANCHOR
Disclosure: this is my own project. I designed the system and the evaluation, and wrote the code with help from an AI assistant (Claude). English isn't my first language, so I also used it to help write this post.