AI browsers in 2026

The short version

An AI browser is a browser with a language model wired into it. In its mild form that is a sidebar that can summarise the page you are on. In its ambitious form — the part the industry calls agentic browsing — the model takes the wheel: it opens tabs, fills forms, clicks through checkouts and logs into accounts on your behalf.

Two things happened in the last month that tell you where this is going, and they point in opposite directions.

On 9 July 2026, OpenAI announced it was shutting down ChatGPT Atlas, its standalone AI browser, less than a year after launching it. Access ends 9 August 2026. Meanwhile the capability itself is being distributed more widely than ever — into a ChatGPT Chrome extension, into the ChatGPT desktop app, and into a cloud browser for agents. OpenAI’s own framing, per TechCrunch’s reporting, is that “the browser is a feature, not the destination”.

And on 30 June 2026, University of Washington researchers published findings that four of the seven agentic browsers they examined could be made to break the same-origin policy — the rule from 1995 that stops one website reading another’s data. Their co-senior author put it about as bluntly as an academic can: “Browser agents aren’t ready for the public.”

So the category is simultaneously consolidating and being handed to far more people. That is worth understanding before you turn one on.

1. What agentic browsing actually means

It helps to separate three tiers, because vendors market them as one thing and they carry very different risks.

• Ask-about-this-page. A sidebar that reads the current tab and answers questions or summarises. It reads; it does not act. Low risk, genuinely useful, and the tier most people will actually use.
• Read-across-the-web. The assistant visits several sites itself and synthesises an answer. Now it is consuming content nobody vetted, on your behalf.
• Act-with-your-credentials. The agent navigates, fills, clicks and submits — inside your logged-in sessions. Booking, purchasing, form-filling, inbox triage. This is where the entire security discussion lives.

The third tier is the one that makes the demos impressive, and it is the one that inherits every problem below. The distinction matters because a browser can be excellent at tier one and dangerous at tier three, and the marketing rarely tells you which you have just enabled.

2. The state of play, July 2026

ChatGPT Atlas launched in October 2025 as a Chromium-based, macOS-first browser with a ChatGPT sidebar, browser memories and an agent mode. It never shipped a public Windows, iOS or Android version. OpenAI announced its retirement on 9 July 2026, with the app deprecated on 9 August. Reporting attributes the decision to an internal push by applications CEO Fidji Simo to cut “side quests” — the same directive under which OpenAI shut down its Sora video app in March 2026. If you use Atlas, export your bookmarks as HTML before 9 August; ChatGPT conversation history lives in your account and is not affected.

Perplexity Comet went the other way. It launched in July 2025 restricted to Perplexity Max subscribers at US$200 a month, then went free worldwide on 2 October 2025. It is now the most accessible way to try agentic browsing, which is a double-edged distinction given what follows.

Gemini in Chrome is the volume play. Google rolled it out free to all United States users on 18 September 2025 as part of what it billed as Chrome’s biggest upgrade. We have not been able to confirm a specific Australian availability date for the full agentic feature set, so check in Chrome rather than trusting a rollout claim — including ours.

Claude for Chrome is Anthropic’s sidebar extension, which moved from a limited research preview to a wider beta alongside its published work on prompt-injection defences. Microsoft Edge has Copilot Mode, and Dia, from The Browser Company, remains in the mix.

The pattern: standalone AI browsers are struggling, and the winners are likely to be agentic features inside browsers people already have. Which means most people will end up with one whether or not they went looking.

3. The security problem is structural, not a bug

This is the part worth reading twice, because it is not the usual “new software has bugs” story.

A language model reads everything — your instructions and the contents of the web page — as one undifferentiated stream of text. It has no reliable way to tell “here is what my user asked” from “here is text that happens to be sitting on this page”. So if an attacker hides instructions in a page, the agent may simply follow them. That is indirect prompt injection, and OWASP’s 2026 State of Agentic AI Security and Governance report maps it to six of the ten categories in its Top 10 for Agentic Applications. It is not one vulnerability. It is the substrate.

What makes it serious in a browser specifically is that the agent acts with your privileges, inside your authenticated sessions. Brave’s security team put the structural argument plainly: traditional web security assumptions do not hold for agentic AI. Same-origin policy and CORS were designed to stop one site reaching into another. They do not contemplate a helpful agent that has legitimate access to all of them at once and can be talked into being the courier.

4. What researchers have actually demonstrated

Two bodies of work matter here.

Brave vs Comet (disclosed 20 August 2025). Brave researchers hid instructions inside a Reddit comment — the sort of thing achievable with white-on-white text, an HTML comment or a spoiler tag. When a user asked Comet to summarise the page, Comet followed the hidden instructions instead of merely summarising them. The proof-of-concept chain went further than data leakage: it extracted the user’s email address from their Perplexity account, retrieved a one-time passcode from Gmail, and exfiltrated both — an account takeover triggered by reading a comment. Brave’s timeline shows a reported fix on 27 July 2025 that it judged incomplete the next day, and a confirmed patch on 13 August. Perplexity disputed the severity, telling reporters the issue was patched before anyone had been harmed and that no user data was compromised; Brave maintained the design remained open to further attacks, and later published a second round of findings on prompt injections hidden in screenshots affecting Comet and others.

The University of Washington study (published 30 June 2026). Researchers at the Paul G. Allen School examined seven agentic browsers — among them ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, Perplexity Comet and Firefox’s AI mode. Four of the seven, they found, created ways to bypass the same-origin policy. They demonstrated a working attack on Atlas in which an embedded malicious site extracted information from another site, in the manner of a fraudulent ad harvesting email data. They also catalogued memory poisoning, where an attacker corrupts what the agent has stored about you so the compromise persists beyond a single session. The work was presented on 26 April at the Agents in the Wild workshop in Rio de Janeiro; co-senior authors were David Kohlbrenner and Franziska Roesner.

5. The vendors are not pretending otherwise

The unusual feature of this story is how candid the companies have been.

OpenAI said in a security update on 30 December 2025 that prompt injection is one of the most significant risks it defends against for agent technology, and that it may never be fully solved. Its mitigations include an adversarially trained model, automated red-teaming driven by reinforcement learning, and a simulator that runs counterfactual rollouts to see how an agent responds to injected instructions.

Anthropic published its browser-use defences on 24 November 2025: reinforcement learning against simulated injected web content, classifiers that scan untrusted content for adversarial commands including hidden text and manipulated images, and continuing red-team work. It reported Claude Opus 4.5 achieving a 1% attack success rate against an internal adaptive Best-of-N attacker — a large improvement on the original research preview. Anthropic’s own characterisation is the honest one: that still represents meaningful risk, and no browser agent is immune to prompt injection.

The United Kingdom’s National Cyber Security Centre has warned that prompt-injection attacks against generative AI may never be fully mitigated, and advises reducing risk and limiting impact rather than assuming prevention.

A 1% failure rate sounds excellent until you consider how many pages a browser agent reads in a week, and that the failure mode is not a wrong answer but an action taken with your credentials.

6. Australia’s cyber agency has already weighed in

On 1 May 2026, the Australian Signals Directorate’s Australian Cyber Security Centre co-published Careful Adoption of Agentic Artificial Intelligence (AI) Services with the United States’ CISA and NSA and with agencies from Canada, New Zealand and the United Kingdom.

It is aimed at organisations rather than individuals, but its risk list reads as a summary of everything above: vulnerabilities inherited from the underlying language model, including susceptibility to prompt injection; a widened attack surface from external tool access; complexity that allows failures to cascade; privilege escalation when agents hold more permission than they need; and accountability gaps created by opaque autonomous decisions.

Its conclusion is the sentence to take away. Until security practices, evaluation methods and standards mature, organisations should assume that agentic AI systems may behave unexpectedly, and should prioritise resilience, reversibility and risk containment over efficiency gain — starting with low-risk applications, expanding autonomy only as controls strengthen, and keeping human oversight on high-impact decisions.

If your workplace has not thought about staff installing agentic browser extensions, that document is the reference to hand them.

Where each option stands, July 2026

7. If you are going to use one anyway

Two heuristics from the security community are more useful than any settings checklist, and both are cited in the OWASP work.

Simon Willison’s lethal trifecta: danger concentrates when an agent has all three of access to your private data, exposure to untrusted content, and the ability to communicate externally. Any two are usually survivable. All three is how data walks out the door. A browser agent logged into your email, reading arbitrary web pages, able to send — that is the trifecta by default.

Meta’s Agents Rule of Two is the operational version: let an agent satisfy at most two of those three properties without a human approving the step.

Translated into practice, and stated plainly as our own advice rather than anyone’s finding:

• Use a separate browser profile for agent mode, not the one holding your banking and email sessions.
• Do not leave an agent authenticated to your inbox. The OTP-retrieval step is what turned Brave’s demonstration from embarrassing into an account takeover.
• Keep confirmation prompts on for anything that spends money, sends a message or changes a password, however tedious.
• Treat summarise-this-page as a different product from do-this-for-me. The first is fine. The second deserves the paranoia.
• Assume anything the agent reads may be trying to talk to it. That includes comments, reviews, PDFs, images and ads — not just pages you consider dodgy.

Should you turn one on?

For the reading tier, yes — a sidebar that summarises a dense page or answers a question about a document you are looking at is a real convenience with a modest risk profile, and it is now free in several browsers.

For the acting tier, our view is that the honest position is the one the vendors and the ASD have both arrived at from different directions: this technology works, it is genuinely useful, and it is not yet trustworthy enough to hold your credentials unsupervised. The failure mode is not a bad summary. It is an action taken in your name because a stranger wrote a sentence on a page you happened to visit.

That will improve. Attack success rates are falling, the defences are real, and the joint guidance exists precisely because governments expect the deployment to happen anyway. But “improving” is not “solved”, and the people building these systems are the ones saying so most clearly.

Meanwhile, the most consequential fact in this article is the quiet one. The standalone AI browser is losing, and the agent is moving into Chrome, into Edge, into the app you already have open. Most people will not choose an AI browser. They will be given one.

Sources

Facts and dates above are drawn from these primary and reputable sources, captured July 2026:

• TechCrunch — OpenAI is shutting down Atlas, but its AI browser ambitions are still growing (9 July 2026), replacement surfaces, “browser is a feature, not the destination”, Simo “side quests” directive
• MacRumors — OpenAI’s ChatGPT Atlas browser is shutting down (10 July 2026), 9 August 2026 end date and October 2025 launch
• OpenAI Help Centre — Evolving Atlas into ChatGPT for browser-based agentic work, official deprecation notice and data-export guidance
• University of Washington News — some agentic AI browsers come with major cybersecurity risks, UW study finds (30 June 2026), seven browsers examined, four same-origin bypasses, Atlas proof-of-concept, memory poisoning, Kohlbrenner quote
• Brave — agentic browser security: indirect prompt injection in Perplexity Comet (20 August 2025), attack chain, disclosure timeline, structural argument about same-origin policy and CORS
• Brave — unseeable prompt injections in screenshots: more vulnerabilities in Comet and other AI browsers
• Decrypt — Perplexity Comet flaw exposed user data to attackers, Brave reports, Perplexity’s response disputing severity
• CyberScoop — OpenAI says prompt injection may never be ‘solved’ for browser agents like Atlas (30 December 2025), OpenAI mitigations and the NCSC position
• Anthropic — mitigating the risk of prompt injections in browser use (24 November 2025), 1% attack success rate for Claude Opus 4.5, classifier and RL defences, “no browser agent is immune”
• Help Net Security — prompt injection still drives most agentic AI security failures in production (11 June 2026), OWASP State of Agentic AI Security and Governance v2.01, six of ten Top 10 categories, lethal trifecta and Rule of Two
• ASD’s ACSC — Careful Adoption of Agentic AI Services (1 May 2026), joint guidance with CISA, NSA, Canada, New Zealand and the United Kingdom
• CISA — guidance helps organizations secure agentic AI, co-sealing agencies and risk categories
• CNBC — Perplexity AI rolls out Comet browser for free worldwide (2 October 2025), original US$200/month Max pricing