What Is an AI Browser Agent, and Can You Trust It With Your Accounts?

An AI browser agent is software that drives a web browser for you: it reads the page, decides what to click or type, and repeats that cycle until your task is done. Some run on the vendor’s cloud computers, like OpenAI’s ChatGPT Work; others act inside your own browser, like Perplexity Comet, Claude in Chrome, and Gemini in Chrome. Can you trust one with your accounts? Partly. Treat it like a capable assistant holding your login: fine for research and errands on low-stakes accounts, risky for banking, your primary email, and anything where a mistake costs real money or privacy.

How does an AI browser agent actually work?

Every browser agent is the same loop wearing different clothes. The agent captures the current state of a page (usually a screenshot, a structured read of the page’s elements, or both) feeds it to a large language model along with your goal, and the model outputs one action: click this button, type this text, open that URL. Then the loop repeats until the job is done.

The two “eyes” have different trade-offs. Reading the DOM (the page’s underlying structure) is fast, cheap in tokens, and precise about which element to click, but it can miss visual tricks. Screenshots give the model true visual grounding, but they cost more and can misjudge coordinates. Most serious products blend both.

Where the loop runs matters too:

• Cloud agents run on the vendor’s machines. ChatGPT Work drives a virtual browser on OpenAI’s servers, which is why tasks keep running when you close your laptop. Your credentials touch their environment, not yours.
• Local agents act inside your browser or desktop app. Claude in Chrome clicks around your actual Chrome session, Perplexity Comet is its own browser on your machine, and Cowork can control your whole desktop. These inherit everything you’re logged into, that convenience is also the attack surface.

A browser agent is different from a chatbot with web search. Search fetches information; an agent takes actions with your privileges, which is why trust is the right question to ask.

Which AI browser agents can you actually use right now?

The field consolidated fast in 2026. OpenAI retired the standalone “ChatGPT agent” and folded it into ChatGPT Work, an agent for longer, multi-step work and finished deliverables, launched July 9, 2026, per its help center. ChatGPT Atlas, OpenAI’s browser launched October 21, 2025, carries agent mode in preview for Plus, Pro, and Business subscribers. Google shut down its Project Mariner prototype in May 2026 and moved the capability into Gemini in Chrome’s auto browse, in US preview for Google AI Pro and Ultra subscribers.

Here’s the honest side-by-side, verified from vendor pages this November:

Product	How it runs	Price (November 2026)	Notable guardrails
ChatGPT Work (OpenAI)	Cloud agent on OpenAI’s virtual computers; local desktop mode too	Included with paid plans (Plus $20/mo; Pro $100/$200/$500/mo)	On-screen approvals, admin toggles, scoped file permissions, event-triggered tasks admin-controlled
ChatGPT Atlas agent mode (OpenAI)	Local agent inside the Atlas browser (macOS at launch, preview)	Browser free; agent mode needs Plus/Pro/Business	Cannot run code, download files, or install extensions; pauses on financial sites; logged-out mode
Claude in Chrome (Anthropic)	Local Chrome extension acting alongside you	Included with paid Claude plans	Site permissions, asks before financial sites, trading/crypto blocked by default, manual-approve mode, 1Password integration
Cowork computer use (Anthropic)	Controls your desktop (macOS/Windows), beta	Pro, Max, and Ultra plans	Per-app permissions, blocklists, prompts before new apps, screenshots visible in chat
Perplexity Comet	Standalone AI browser, Mac/Windows/iOS/Android	Browser free; Background Assistants on Max ($200/mo or $2,000/yr)	Pause control, privacy settings, post-fix injection mitigations
Gemini in Chrome (Google)	Agent inside Chrome itself, US preview	Needs Google AI Pro or Ultra subscription	Pauses and asks confirmation for purchases and social posts; password manager use requires permission
Dia (The Browser Company, now part of Atlassian)	Standalone browser, Mac-first, beta	Free without AI; $10/mo “Better Answers”; $100/mo “Better Days”	Task-based usage caps, no overage billing, enterprise options
Genspark AI Browser	Local browser plus cloud Super Agent	Browser free; Plus $24.99/mo; Pro $249.99/mo	Credit metering, visible step-by-step task execution

Who each fits: ChatGPT Work for existing ChatGPT subscribers who want finished documents; Claude in Chrome for careful users who want granular permissions; Comet for a free, cross-platform start; Gemini in Chrome for anyone who won’t switch browsers; Dia for Mac users who want polish; Genspark for tinkerers who want its 700-plus MCP Store integrations.

What have security researchers actually found?

This is where the trust question gets real. Indirect prompt injection is an attack where instructions are hidden in content the agent reads (invisible text, HTML comments, even pixels in an image) and the agent executes them as if they were yours. It can’t reliably tell attacker text from yours, to the model, it’s all just context.

Brave’s researchers documented the cleanest proof. In their August 2025 disclosure on Comet, hidden text on a page made the assistant fetch the user’s email address, trigger a one-time password, read that code out of the user’s logged-in Gmail, and post it back to the attacker: all after a single “summarize this page” click, with “no further user input.” Their follow-up in October 2025 showed attacks hidden in images imperceptible to humans. Brave’s core warning has aged well: the agent “operates with the user’s full privileges across authenticated sessions,” so the browser’s usual origin-based defenses don’t protect you.

Others piled on. SquareX researchers showed malicious extensions could spoof an AI browser’s sidebar and abuse agent APIs, and Zenity Labs published a threat analysis of Claude in Chrome. Wiz flagged Atlas’s shared-session risks the day after it launched. Academia confirmed it wasn’t hype: a UC Davis study in August 2025 found AI browsing assistants collecting banking details, tax numbers, and medical records without users’ knowledge, and a December 2025 arXiv evaluation of eight browser agents found them mishandling consent prompts and weakening browser protections.

In October 2026, Axios reported that major US banks were detecting unvetted third-party AI agents inside customer accounts, some doing things owners never asked for, and Reuters confirmed banks were blocking them. The trust question is no longer theoretical.

What do the vendors themselves admit?

OpenAI’s deployment safety notes for the original agent state that it disabled ChatGPT’s memory feature at launch to cut exfiltration risk, and its published evaluation showed the model alone resisted active data-exfiltration attempts 67% of the time: the other mitigations exist because that number isn’t 100. OpenAI also says Atlas’s agent “cannot run code in the browser, download files, or install extensions,” pauses on sensitive sites like financial institutions, and offers a logged-out agent mode to limit blast radius. In December 2025 it shipped an adversarially trained model specifically to resist injection.

Anthropic is the most blunt: in its prompt-injection research it states “No browser agent is immune to prompt injection,” reporting roughly a 1% attack success rate against its hardened setup, and its safety guide tells users the risk “is not zero” and to avoid financial accounts, legal documents, and medical data. Its Cowork guidance admits there’s “no sandbox” around desktop computer use. Google’s auto browse is built to “pause and explicitly ask for your confirmation” on purchases and social posts. None of these companies claims their agent is safe with your bank account.

OpenAI’s own launch testing showed the agent model alone resisted active data-exfiltration attempts 67% of the time. The remaining defense isn’t the model: it’s layered monitoring, guardrails, and you.

What data do these agents actually touch?

Short version: anything on screen. Claude’s extension takes screenshots of your active tab, and Anthropic’s help docs note that anything visible (personal, sensitive, third-party) enters the conversation and can’t be filtered out. ChatGPT’s agent sees pages via screenshots of its virtual browser, stored in your chat history until you delete them, and cookies persist between sessions like a normal browser. Cowork screenshots your whole desktop, so close what you don’t want seen.

Connectors widen the pipe. Linking Gmail, Google Drive, Slack, or GitHub gives the agent a data source beyond the visible page, and OpenAI’s docs advise “extra caution” because an injection could reach that connected data. On the plus side, vendors give you controls: Atlas doesn’t train on your browsing by default and lets you block specific sites, and deleting browsing data removes associated browser memories.

Which guardrails actually matter?

Not all safety features are equal. Based on what’s shipped and what researchers bypassed, check for these before you delegate anything:

• Manual approval mode. Claude in Chrome defaults to screening its own actions; “Manually approve” means you review every step. Slower, far safer.
• Site allowlists and blocklists. Anthropic blocks high-risk categories by default and lets admins restrict Claude to approved sites only. The restrictive allowlist is the strongest pattern available today.
• Logged-out or separate-session operation. Atlas’s logged-out agent mode and Anthropic’s “use a separate browser profile” advice shrink what an injection can reach.
• Human takeover and watch mode. ChatGPT’s agent pauses at logins so you type credentials yourself, without screenshots captured mid-entry; watch mode auto-pauses if you walk away; Comet offers one-click pause.
• Credential proxying. Claude’s 1Password integration signs in without the agent ever seeing the password. This should be standard everywhere.

A safe setup procedure you can follow in an afternoon

Start with this setup. It takes under an hour.

1. Pick a low-stakes task first: price research, drafting a summary, filling a practice form. Nothing with money or identity attached until the tool has earned it.
2. Create a separate browser profile for agent work, as Anthropic’s docs advise. No saved logins for banking, your primary email, healthcare, or government portals in it.
3. Use separate accounts where you can. A dedicated email for agent signups keeps your main identity out of reach.
4. Turn on the strictest approval setting: manual approve in Claude, confirmations in Comet and Gemini, watch mode in ChatGPT. Loosen later if you want.
5. Connect the minimum. Add only connectors you’ll actually use and audit the list monthly: every connected app is data an injection can touch.
6. Disable memory and training options. Turn off “improve the model” data controls and block sites you care about in Atlas.
7. Never give it passwords in chat. Log in yourself via takeover mode, or use a credential manager integration that hides secrets.
8. Run one supervised test. Watch every click. You’re learning its failure modes while nothing’s at stake.
9. Clear browsing data and revoke sessions after anything sensitive.
10. Keep everything updated and watch your money. Injection flaws get patched fast, and banks are blocking rogue agents: check statements for actions you didn’t request.

None of this is legal or compliance advice. If you handle regulated data (health records, client PII, financial records) talk to your security or legal professional before letting any agent near it. Anthropic’s own docs say its Chrome tool isn’t covered under HIPAA business associate agreements.

The bottom line

AI browser agents are genuinely useful in late 2026, and genuinely not ready to hold your most important keys. The research record (Brave’s account-takeover chain, the universities’ privacy findings, banks blocking rogue agents) says the failure mode is real and recurring. The vendors’ own documents agree.

So use them, with structure. Give agents a separate profile, low-stakes accounts, and manual approval until they’ve proven themselves. Keep banking, your primary email, and anything regulated out of reach. If you want one tool to start with: Comet for a free cross-platform try, ChatGPT Work if you already pay for ChatGPT, Claude in Chrome if you want the most granular permission controls. Start small, watch closely, and expand only what you’d be comfortable explaining to your bank.

FAQ

What is an AI browser agent?

An AI browser agent is software that operates a web browser on your behalf. It observes pages through screenshots or page structure, decides what to do, and takes actions like clicking, typing, and navigating until the task is done. Examples in November 2026 include ChatGPT Work, ChatGPT Atlas agent mode, Claude in Chrome, Perplexity Comet, Gemini in Chrome’s auto browse, Dia, and Genspark.

How does an AI browser agent work?

It runs a loop. Each cycle, the agent captures the page state as a screenshot, a structured read of the page’s elements, or both, sends that to a large language model, and the model outputs an action: click this, type that, open this URL. Then the loop repeats until the goal is met. Cloud agents such as ChatGPT Work run on vendor virtual machines; others run inside your own browser.

Which AI browser agents are available right now?

As of November 2026: ChatGPT Work (OpenAI’s long-task agent, July 2026) and agent mode in the free Atlas browser; Claude in Chrome, generally available since August 26, 2026, plus computer use in Claude’s Cowork desktop app; Perplexity Comet, free on Mac, Windows, iOS, and Android; Gemini in Chrome’s auto browse in US preview for AI Pro and Ultra; Dia; and Genspark’s AI Browser.

Can you trust an AI browser agent with your accounts?

Partly. Use it with low-stakes accounts and strong supervision, but keep banking, your primary email, and healthcare or government logins out of reach. Researchers at Brave, SquareX, and several universities have shown hidden instructions in web pages hijacking agents into leaking data from logged-in sessions. Vendors themselves confirm the risk is reduced, not eliminated.

What is prompt injection, and why does it matter for AI browsers?

Indirect prompt injection is an attack where malicious instructions are hidden in content an agent reads, such as invisible text on a webpage. The agent cannot reliably tell those instructions from yours, so it may execute them: visiting your accounts, reading emails, or sending data to an attacker. Brave demonstrated a full Perplexity account takeover this way in August 2025, and variants keep appearing.

How much do AI browser agents cost?

Perplexity Comet and Genspark’s browser are free, with paid tiers from $10 to $250 per month. ChatGPT Atlas is free with a ChatGPT account; agent mode needs Plus ($20/month) or higher, and ChatGPT Work targets paid plans up to Pro ($100 to $500/month). Claude in Chrome is included with paid Claude plans, and Dia charges $10 or $100 per month for its AI tiers.

Can AI browser agents see my passwords?

Generally no, and vendors build around it: ChatGPT’s takeover mode stops capturing screenshots while you type credentials, Atlas can run agent mode logged out, and Claude in Chrome can use 1Password to sign in without seeing the password. But the agent sees everything else visible on screen, including logged-in sessions, so treat every page it views as shared.

What should I never let an AI browser agent do?

Avoid bank transfers and investment logins, your primary email, medical or government portals, and mass actions on accounts you cannot afford to lose. OpenAI’s agent is trained to refuse bank transfers and Anthropic blocks trading and crypto apps by default, but guardrails are not absolute. Confirmations, manual approval, and a separate profile are your real safety net.

Which AI browser agent is best for beginners?

Perplexity Comet is the easiest start: it is free, works on Mac, Windows, iOS, and Android, and has a one-click pause control. Gemini in Chrome suits people already in Google’s ecosystem but is still in US preview. ChatGPT Work suits Plus and Pro subscribers who want finished deliverables. Start with read-heavy tasks before letting any agent act on accounts.

How do I set up an AI browser agent safely?

Use a separate browser profile and separate accounts where possible. Log out of sensitive sites or run agent mode logged out. Turn on the strictest approval mode, connect only the apps you need, and disable memory and training options. Test on throwaway tasks, clear browsing data after sensitive sessions, keep the browser updated, and never type passwords into chat.

Sources

• Introducing ChatGPT agent: OpenAI
• ChatGPT agent: OpenAI Help Center
• ChatGPT agent deployment safety notes: OpenAI
• ChatGPT Work and Codex: OpenAI Help Center
• Introducing ChatGPT Atlas: OpenAI
• Continuously hardening ChatGPT Atlas against prompt injection: OpenAI
• Mitigating the risk of prompt injections in browser use: Anthropic
• Use Claude in Chrome safely. Claude Help Center
• Let Claude use your computer in Cowork: Claude Help Center
• Claude in Chrome: A Threat Analysis. Zenity Labs
• Comet: Perplexity
• Perplexity Help Center (plans and Max pricing)
• Indirect Prompt Injection in Perplexity Comet: Brave
• Unseeable Prompt Injections. Brave
• The new era of browsing: Putting Gemini to work in Chrome. Google
• Dia plans and pricing: The Browser Company
• Genspark AI Browser: Genspark
• Scoop: Unvetted AI agents are accessing U.S. bank accounts. Axios
• US banks are blocking third-party AI agents’ access to customer accounts. Reuters
• UC Davis study reveals alarming browser tracking by GenAI assistants
• Privacy Practices of Browser Agents: arXiv
• Exploring the Risks of ChatGPT’s Atlas Browser. Wiz