Notion's Agent Can Now Fill Out Forms on the Web. First, Check Whether You Get It.

TL;DR: Notion’s rebuilt agent can browse the web and submit forms, and Notion itself lists prompt injection and data exposure as risks. The full agent and the new monthly credits come with Business and Enterprise. Plus gets a limited trial, so check your plan before you plan around it.

Notion’s agent can now fill out forms on the web. I’m deciding between Plus and Business, so the first thing I checked wasn’t what the agent can do. It was whether I’d get it. I haven’t tried it, so this is my read of the October 19 release and the pricing pages.

The release is called “Agents, rebuilt to do more for less.” The agent gets its own computer and browser, better context handling, a “Review for me” mode with safety checks, and it can work on a task for up to 24 hours.

What Plus Doesn’t Get

On Plus, Notion AI is a trial. Free and Plus users get a limited number of complimentary AI responses to try things out, and the pricing table marks Notion Agent “Limited Trial” for both. The full thing lives on Business and Enterprise.

The new credits split the same way. Business and Enterprise seats get 1,500 Standard credits a month, for work where Notion picks the model, and 500 Select credits, for when you pick the model or run Custom Agents. No page I opened gives Plus either kind.

You can’t buy your way around it on Plus, either. Notion’s credits page says, “Notion credits are an add-on for Business and Enterprise plans.” They run $10 per 1,000 monthly or $13 per 1,000 annual, and you buy them through your account team.

One line I can’t pin down. The Custom Agents line on the pricing page says “Free to try, then $10 per 1,000 monthly Notion credits,” but the table only marks Custom Agents as needing credits in the paid AI columns. I can’t tell what that means for Plus, so I’m leaving it unclear.

The Browser Is the Real Change

With browsing on, the agent can click through pages, fill out and submit forms, and download files, then bring the results back into Notion. Search answers questions. Browsing acts.

Whether it starts on is murky. The help page says browsing “is on by default for most plans,” and that on Enterprise, or with an account manager, an admin has to turn it on first. The same page also says it “stays off until you turn it on.” The page doesn’t say which applies to you on a plan below Enterprise.

Every Page Is a Possible Instruction

Notion lists the risks itself. The one I’d think about first is prompt injection, which Notion describes this way: “A website or code your agent opens could contain instructions that try to change what your agent does.”

In practice, that means every web page and form the agent reads is an attack surface. The agent reads it, and the page can talk back. Notion also lists data exposure, where the agent could send info from your chat to an external service, and untrusted code. Its own summary: “These risks can’t be eliminated completely when an AI agent connects to the open internet.”

That’s an honest sentence from a vendor. You can watch each page the agent visits and each action it takes, and you can turn browsing off in the agent settings.

Credits and the 90% Claim

The credit system is live now for new customers. Existing customers move over on November 2.

Standard credits pair with Auto, Notion’s model router. Notion says that across 20+ common tasks, Auto got results similar to Opus 5.5 and Astra at about 90% lower average cost, so credits go about 10 times further. That’s Notion’s test on tasks Notion picked. Notion doesn’t publish the 20+ tasks or say how it judged “similar results.” Notion also estimates most users won’t run out of credits. Also their estimate.

Spending limits are coming in an “AI Command Center,” marked “Coming soon.”

What I’d Do

My read, and it’s only a read: this looks like Notion’s answer to the other recently released agents, Grok Bot, Muse and Dots, since it has the same kind of features and aims. Notion doesn’t say that.

On Plus, I’d treat the agent as a trial and not build anything that depends on it. If I went to Business, the first thing I’d do is open the agent settings, check the web browsing switch, and decide on purpose.

I still haven’t picked between Plus and Business.