Agentic browser

What is an agentic browser?

An agentic browser is a web browser with an AI agent built in that does things on websites for you. You give it a goal, such as "find the cheapest return flight to Lisbon in the second week of October and hold the seat", and it opens the pages, reads them, clicks, fills in forms and comes back when it is done or stuck. A chatbot answers questions about a page. An agentic browser acts on the page.

The difference that matters is the session. The agent runs inside your browser, so it sees what you see and it is logged in where you are logged in: webmail, the bank, the webshop with your card on file, the admin console of your CRM. That is what makes it useful and what makes it dangerous.

The category took shape in 2025 and has already moved once. Perplexity's Comet launched in July 2025 and has been free since October 2025. OpenAI's ChatGPT Atlas launched in October 2025, never left macOS and stopped working on 9 August 2026; OpenAI now builds the browser agent into ChatGPT and Codex instead of shipping a separate browser. Google's auto browse in Chrome, driven by Gemini, went live on desktop in January 2026 and on Android from the end of June 2026, for paying AI subscribers in the US. Microsoft's Copilot Mode in Edge takes actions on consumer devices in the US, and Edge for Business has had agentic browsing in limited preview since May 2026, not yet in the European Economic Area. Opera Neon shipped in September 2025 as a paid browser built around its agent, called Neon Do.

How an agentic browser works

Every product uses the same loop, in three parts.

Reading the page. The agent gets the page as text, either the document structure the browser already holds (the same tree a screen reader uses) or a screenshot that a vision model reads. Both include things you never see: hidden elements, alt text, text inside an image, a comment behind a spoiler tag.

Planning. The language model turns your goal into steps: open the search page, enter the dates, sort by price, open the first result, check the baggage rules. Chrome's auto browse shows you that plan before it starts.

Acting. The agent clicks, types, scrolls and switches tabs, then reads the new page and decides the next step. It repeats until the goal is reached, until it hits something it is not allowed to do, or until you stop it. Most products pause at the same points: logging in, entering a card number, paying, posting on social media. Chrome, Comet and Edge for Business all name those checkpoints in their documentation.

The security problem

Put two facts next to each other. The agent is logged in to everything you are logged in to. And every web page it reads is untrusted content written by someone else. Prompt injection, a curiosity when a chatbot could only talk, becomes a data-theft path when the reader can also act.

Brave's security team showed the pattern against Comet in August 2025. They wrote a Reddit comment with instructions hidden behind a spoiler tag. A user who clicked "summarise this page" got a summary, and meanwhile the agent followed the hidden text: it opened the user's Perplexity account page, copied the email address, triggered a one-time login code, read that code from the user's Gmail tab, and posted both back into the Reddit thread as a reply. The user saw nothing. Two months later Brave repeated the trick with near-invisible text inside an image, picked up when the agent took a screenshot, and then with text at zero opacity on a page that Opera Neon summarised. Each time the agent walked to an account page and sent data out.

The vendors do not claim this is fixed. OpenAI's chief information security officer wrote at the Atlas launch that prompt injection "remains a frontier, unsolved security problem", and OpenAI's December 2025 update on Atlas said these attacks may never be completely eliminated. Brave concluded in June 2026 that indirect prompt injection "cannot be fully solved within the current LLM architecture", because the model reads your instructions and the attacker's page in one context and cannot tell them apart. Running the model on your own machine does not change that; Brave tested an on-device tool and got the same result.

What the vendors do instead is narrow the damage. Atlas had a logged-out mode, where the agent browsed with no cookies, and a watch mode that paused on sensitive sites such as banks. Brave's own AI browsing runs in a separate, logged-out profile that you have to start on purpose. Edge for Business only lets Copilot act on domains the IT team listed. Chrome asks before a purchase. Those are the controls you have to work with.

Agentic browser versus computer-use agent

The two get confused, and the useful way to separate them is by what the agent can reach.

An agentic browser reaches everything inside the browser session: open tabs, cookies, saved logins, the password manager if you allow it, and every site you are signed in to. It stops at the browser's edge. Atlas, for example, could not run code, download files, install extensions or touch other apps or the file system.

A computer-use agent, such as the computer use tool in Anthropic's API, reaches the whole desktop of the machine it runs on. It takes screenshots and drives the mouse and keyboard, so it can open a spreadsheet, a terminal, an ERP client and a browser in the same task. Because of that reach, Anthropic's own guidance is to run it in a dedicated virtual machine with minimal privileges, no stored login details, and an allowlist of domains it may visit.

So the browser agent has less reach but starts with your real identity, because it lives in the browser you use every day. The computer-use agent has more reach but usually lives in a sandbox you built for it, with nothing of yours inside. For an SME the second setup is often the safer one, precisely because the agent can reach a lot but there is little to reach.

What an SME should decide before staff use one

1. Who may use it, and on which machine. An agentic browser is a new application with access to every web account on that profile, so treat the rollout like handing someone a shared password. Start with a few people whose day is full of repetitive web work: quotes from suppliers, price comparisons, travel, subscriptions.

2. Which accounts it may be logged in to. Give the agent its own browser profile with only the accounts it needs for its tasks. Keep personal mail, banking, payroll, the cloud admin console and any system with customer data out of that profile. If the product has a logged-out or isolated mode, make that the default for anything that does not need a login.

3. Where it must stop. Payments, sending messages in your name, changing settings, deleting things. Check what the product pauses on by default and whether you can add sites to that list. Edge for Business lets IT set an allowlist of domains where Copilot may act; if your staff use Chrome or Comet, the equivalent is a separate profile with nothing sensitive in it.

4. What you do when it goes wrong. Decide now who gets told when the agent does something odd, and how you close the session, because a steered agent keeps following the page's instructions until the task ends.

Two exclusions are worth writing down as rules rather than advice: no agent tasks while logged in to a bank or payment provider, and no agent tasks in the admin console of anything. The demonstrated attacks all walked to an account page and read out what was there. The less there is to read, the less there is to lose.

Your website, visited by agents

The flip side is that agents are now among the visitors to your site, acting for a customer who asked them to compare offers, request a quote or book a slot. An agent that cannot get through your form does not try harder, it goes to the competitor whose form it can fill.

A few things help. Standard HTML forms with labelled fields, and no essential step hidden in a pop-up or a drag-and-drop widget. Prices, stock and opening hours in the page text and in structured data, so the agent does not have to guess from a picture. A short /llms.txt file, a Markdown page proposed by Jeremy Howard in 2024 and now in its second version, that points an agent to the pages that matter: your product list, your pricing, your contact form.

Chrome is going a step further with WebMCP, a proposed standard in origin trial since Chrome 149 (June 2026), where a site declares its actions as tools: a JavaScript call such as navigator.modelContext.registerTool(), or attributes like toolname on an ordinary form. Booking.com, Shopify and Etsy are among the early testers. Sites that describe what an agent can do on them will get the agent's business.

What to watch out for with agentic browsers

The demo never shows the second tab. Product demos run in a clean profile. The risk lives in the tabs the demo does not show: the mailbox and the admin console that are also open.

A plan you approved is not a plan the agent will keep. The plan is written before the agent reads the pages. A page can change the plan halfway. Confirmation before an action is worth more than confirmation of the plan.

Vendor defaults change with an update. Atlas went from launch to shutdown in under ten months. Watch modes, allowlists and logged-out defaults are product features, and features move. Re-check your settings after every major update.