What is an agentic browser?
An agentic browser takes a task in plain language and completes it on the web: it reads pages, decides the next step and executes it with clicks and keystrokes. An AI browser that only summarises the page is an assistant. Once it can submit a form, it is an agent, and the security model changes at exactly that line.
The mechanism matters more than the feature list. The agent sees the page as content, decides what to do, and acts with your identity. Your cookies, your SSO session, your saved passwords and your open tabs are all in reach, because that is what makes the agent useful. The same access is what makes it dangerous.
Why page content can hijack the agent
The model reads your instruction and the page in the same context window. It has no reliable way to know that a sentence in a Reddit comment is data and not a command. Security people call this indirect prompt injection. In a browser agent it turns into the classic confused-deputy problem: a trusted actor with broad access, steered by an untrusted party.
Brave's researchers showed the full chain against Perplexity Comet in August 2025. A user asked Comet to summarise a Reddit thread. Hidden text in a comment told the agent to open the user's account page, read the email address, trigger a one-time-password login, read the code from the user's logged-in Gmail and post both back as a reply. Brave reported it on 25 July 2025; Perplexity shipped a fix two days later, and Brave's retest found it incomplete. The specific bug is less important than the shape: every step used access the user had legitimately granted.
Brave's recommended fixes are the right checklist for any vendor review: separate user instructions from page content, check each planned action against what the user asked, require explicit confirmation for sensitive actions, and keep agentic browsing isolated from normal browsing.
What Gartner told security teams
Gartner's December 2025 report, Cybersecurity Must Block AI Browsers for Now (Dennis Xu, Evgeny Mirolyubov and Jon Watts), advised CISOs to block AI browsers outright. Its reasoning, as summarised by Forcepoint: default settings put user experience ahead of security, autonomy plus authenticated access is the threat, and the services can leak sensitive data. For organisations with more risk tolerance, the report listed prompt injection, unapproved data sharing, credential abuse and shadow IT as the risks to mitigate.
Ten months later the advice still holds for default configurations. What changed is that vendors shipped the controls that make a narrower policy possible.
The 2026 field, by what it lets you control
For a CTO the useful comparison is not which agent is smartest. It is what each one lets an administrator constrain. Status as of 31 October 2026, from vendor announcements and the nohacks.co landscape tracker.
| Browser | Maker | What the agent does | Controls that matter | Availability |
|---|---|---|---|---|
| Perplexity Comet | Perplexity | Fills forms, compares products, completes multi-step tasks | Comet Enterprise: silent MDM install; admins can allow answers only, or actions only on approved domains | Desktop, Android, iOS |
| Gemini in Chrome (auto browse) | Scrolls, clicks and types in a separate marked tab | Buy and post buttons stay with the user; password autofill needs approval; daily action limit | US, AI Pro and Ultra plans | |
| Claude in Chrome | Anthropic | Acts on sites and fills forms from a side panel | Per-site permissions; since general availability a safety classifier checks actions instead of per-action approval | Paid plans, desktop Chrome |
| Opera Neon | Opera | Chat, Do and Make modes; can be driven by outside agents | Consumer product; no enterprise console documented | Free and paid plans |
| Dia | The Browser Company (Atlassian) | AI assistance across tabs for knowledge work | Check current admin options before rollout | macOS; Windows announced |
| ChatGPT Atlas | OpenAI | Agent mode for multi-step tasks | No longer available | Retired 9 August 2026 |
Two design choices separate the field. Google keeps the irreversible click with the human: Gemini prepares a purchase or a post, and the user presses the button (9to5Google, January 2026). Perplexity's enterprise build lets admins restrict actions to approved domains or switch actions off (Perplexity). Anthropic went the other way on friction: since Claude in Chrome became generally available on 26 August 2026, a safety classifier screens actions instead of asking the user to approve each one. That is better UX and a different trust assumption, so it belongs in your review notes.
The market is also moving fast enough to break a policy. OpenAI retired ChatGPT Atlas on 9 August 2026, a month after announcing it, and moved its agent features into the ChatGPT desktop app and Chrome extension (Notebookcheck). Any approval you grant should name a product version and an expiry date.
A three-tier policy
Blocking everything pushes people to personal devices, where you see nothing. Allowing everything hands an injectable agent your SSO session. The workable middle is tiers.
- Block by default on managed devices. Standalone agentic browsers and agent extensions stay off the allow-list. Agent features inside approved browsers stay disabled by enterprise policy.
- Sandbox for exploration. Agent browsing runs in a separate profile or agent-owned browser with no corporate logins, no password manager and no access to internal domains. Most of the research value survives; most of the blast radius does not.
- Pilot on an allow-list. Named teams, named tasks, actions limited to approved domains, sensitive actions confirmed by a human, and a review date. Procurement research and form-heavy back-office work are the usual first candidates.
Questions for the vendor review
- Can an admin restrict agent actions to specific domains, or turn actions off while keeping answers?
- Which actions always require a human click: purchases, sends, posts, credential use, security warnings?
- Does the agent run in the user's own session or in an isolated one?
- What page content and screenshots leave the device, where are they stored, and are they used for training?
- What does the audit log show, and can it go to your SIEM?
If a vendor cannot answer the first two, keep it in the sandbox tier. For the broader threat model, see agentic AI security and the agentic AI pillar.
Related questions
Frequently asked questions
What is an agentic browser?
An agentic browser is a web browser with an AI agent built in that can act on pages, not only read them. You describe a task, and the agent scrolls, clicks, types and moves between sites to finish it, usually inside the sessions you are already logged into. Perplexity Comet, Gemini in Chrome with auto browse, Claude in Chrome and Opera Neon are the main examples in 2026.
Are agentic browsers safe for enterprise use?
Not with default settings on a device that holds production credentials. The core problem is indirect prompt injection: text on any page the agent reads can carry instructions, and the agent acts with the user's logged-in access. Gartner advised blocking AI browsers in December 2025. They become manageable when agent actions are limited to approved domains, sensitive steps need a human click, and agent browsing runs separately from the user's own sessions.
What is the difference between an AI browser and an agentic browser?
An AI browser adds a chat assistant that can summarise or answer questions about the page you are on. An agentic browser lets that assistant take actions: fill forms, click buttons, navigate and complete multi-step tasks. Brave Leo and Firefox's AI features are assistants; Comet, Gemini auto browse and Claude in Chrome are agentic. The security model changes at that line, because reading is low-risk and acting is not.
What happened to ChatGPT Atlas?
OpenAI announced on 9 July 2026 that it would retire ChatGPT Atlas, and the browser stopped working on 9 August 2026. Its agent features moved into the ChatGPT desktop app and the ChatGPT extension for Chrome. Teams that piloted Atlas need to re-run their review against whichever of those replaced it.
How do you block agentic browsers on company devices?
Block the standalone browsers through your MDM or application allow-list, then deal with the agent features inside browsers you already allow. Chrome, Edge and Firefox expose enterprise policies for their AI features, and Firefox has had a central kill switch for generative AI since Firefox 148. For browser extensions that add agents, manage the extension allow-list. Check each vendor's current admin documentation, since these controls changed several times in 2026.