Quick Answer
AI browsers like Perplexity Comet and agent modes in Chrome and Edge can act on your behalf, but that power makes them vulnerable to prompt injection: hidden instructions in web pages, emails, or documents that hijack the AI. OpenAI and security researchers say the risk likely can’t be fully solved, so limit each agent’s access and confirm sensitive actions.
Key Takeaways
- The exposure: AI browsers act with your logged-in access to email, banking, and files, so one attack can reach a lot
- The threat: prompt injection hides instructions in a page, email, or doc that the AI follows as if you wrote them
- No full fix: OpenAI and the UK’s NCSC say prompt injection likely can’t be fully solved; it is structural
- Not one vendor: researchers have shown real attacks across multiple AI browsers, not a single product
- Protect yourself: limit permissions, keep sensitive logins out, require confirmation to send or pay, avoid financial data
AI browsers went mainstream in 2026. Tools like Perplexity’s Comet, The Browser Company’s Dia, and agent modes arriving in Chrome and Edge promise to book your appointments, fill your carts, and summarize your inbox, doing the clicking for you. The productivity pitch is real. So is a security problem the companies building these tools have openly admitted they cannot fully fix.
That problem is prompt injection, and understanding it is the difference between using an AI browser safely and handing a stranger the keys to your accounts. This is how the risk works, why it is so stubborn, and the concrete steps that keep you protected. One sign of how seriously the industry takes it: OpenAI is retiring its own ChatGPT Atlas browser on August 9, 2026, with security concerns among the reasons cited, and folding its agent features into other products.
What are AI browsers, and why are they risky?
A traditional browser shows you web pages. An AI browser adds an agent that can act inside those pages on your behalf, reading, clicking, typing, and completing multi-step tasks using the same logged-in access you have. If you are signed into your email, bank, and cloud storage, so is the agent. For a primer on the underlying technology, see our explainer on what an AI agent is.
That is exactly what makes them powerful and what makes them risky. As OpenAI put it, a browser agent that helps you get more done also becomes a higher-value target for attackers. A chatbot that only answers questions is low-stakes; an agent that can move money, send email, and open files is a much bigger prize. The risk is not one specific product, it is the whole category, which is why this sits alongside broader agentic AI security risks.
What is prompt injection?
Prompt injection is an attack that smuggles hostile instructions into content the AI reads, causing it to follow the attacker’s commands instead of yours. It comes in two forms. Direct injection is typed straight into the chat. The more dangerous kind for browsers is indirect injection, where the malicious instructions are hidden inside a web page, email, PDF, or calendar invite the agent processes during a task.
The instructions can be invisible to you: white text on a white background, tiny fonts, or hidden HTML. In a scenario OpenAI describes, a malicious email could tell an agent to ignore your request and quietly forward your tax documents to an attacker. You ask the agent to summarize your unread email, it reads the booby-trapped message, and it follows the hidden order. Security researchers have demonstrated the same trick to attempt to exfiltrate data and even trigger actions on logged-in sites. One widely cited demonstration against Perplexity’s Comet was nicknamed “CometJacking,” and in a separate 2026 test researchers reported tricking six different AI browsers, including Atlas, into leaking user credentials.
Can prompt injection be fixed?
Not completely, according to the people building these tools. OpenAI has said plainly that prompt injection is unlikely to ever be fully solved, and its security chief has called it a frontier, unsolved problem. The UK’s National Cyber Security Centre similarly warned that these attacks against generative AI may never be totally mitigated, advising professionals to reduce the risk rather than assume it can be stopped.
The reason is structural. An AI agent reads all text, your instructions and the web’s content, through the same pipeline, and it cannot reliably tell an approved command from a malicious one buried in a page. Vendors are fighting back with adversarial training, architectural limits, and human confirmation steps, and those genuinely reduce risk. But as long as agents read untrusted web content while holding your credentials, the exposure remains. A useful way to think about it: risk equals autonomy multiplied by access, and AI browsers combine meaningful autonomy with very high access.
How risky are today’s AI browsers really?
Risky enough that caution is warranted, though not identical across products. Independent enterprise testing in 2026 found leading AI browsers blocked only a small share of malicious test pages, a reflection of how new and unsolved the attack surface is rather than a single company’s failure. Research firm Gartner went as far as advising enterprises to block AI browsers for the time being, and many organizations now restrict them to approved tools and keep sensitive workflows off agentic browsers entirely.
The core issue is blast radius. Because an agent operates with your authenticated sessions, a single successful attack can potentially reach your email, banking, corporate systems, and cloud storage at once, and the documented techniques often require no action from you beyond normal browsing. That is a different, broader kind of exposure than the malware and phishing browsers were built to stop.
What does the ChatGPT Atlas shutdown tell us?
The retirement of ChatGPT Atlas is a real-world signal that the standalone AI-browser model is under pressure, and that security was part of the problem. OpenAI confirmed Atlas will stop working on August 9, 2026, less than a year after its October 2025 launch, and is moving its agent capabilities into the ChatGPT desktop app and a new Chrome extension.
Reporting on the shutdown cited several reasons, including difficulty differentiating from Chrome and, notably, prompt-injection and other cybersecurity concerns. But an important caveat matters for your safety: retiring the browser does not retire the risk. The same agentic capabilities, and the same prompt-injection exposure, move into ChatGPT Work and the browser extension, and some analysts note the attack surface there may actually be broader. If you used Atlas, you will need to export your data before the cutoff, which we cover in our guide to the ChatGPT Atlas shutdown and data export. The lesson is that this is a property of agentic browsing itself, not of one product that can be discontinued away. Any replacement that lets an AI act on the web with your credentials inherits the same fundamental exposure.
Should you use an AI browser?
For most everyday tasks, the honest answer in 2026 is: cautiously, or not yet. Several security specialists argue that for typical use, agentic browsers do not yet deliver enough value to justify their risk profile, given their access to sensitive data. Even vendors advise against pointing them at regulated or production data.
That does not make them useless. For low-stakes, transactional workflows such as comparison shopping, research, and booking, run by someone who maintains strict separation from sensitive accounts, the trade-off can be reasonable. The same caution applies before you let an agent handle money, which we cover in our look at AI agents, shopping, and payments. The key is matching the task to the risk, and never assuming the agent is as skeptical as you are. If you are weighing whether a given AI tool is trustworthy in general, our guide on whether an AI is safe to use applies the same mindset.
How can you use AI browsers safely?
You cannot eliminate prompt injection, but you can shrink its impact dramatically by changing how you use these tools. The goal is to reduce both the agent’s autonomy and its access, since risk depends on both.
- Limit access to what the task needs. Do not connect your primary email, cloud storage, or payment methods unless there is a clear reason. The less an agent can see, the less an attacker gains.
- Use a separate browser profile. Run the agent in a profile with no sensitive sessions logged in, so a hijack cannot reach your bank or main inbox.
- Require confirmation for sensitive actions. Never let an agent send email, make purchases, or change account settings without asking you first. Confirmation breaks long attack chains.
- Give specific instructions, not open-ended ones. “Summarize this one page” is safer than “check my inbox and do whatever is needed.” Wide latitude makes hidden instructions easier to exploit.
- Keep regulated and financial data out. Follow the vendors’ own advice and avoid using agentic browsing for banking, health, or work-confidential material.
- Watch for trouble. If an agent behaves oddly or you suspect an account was touched, change passwords and check whether your email was in a data breach.
The bottom line: AI browsers are a genuine leap in convenience built on a security problem the industry has not solved. Treat the agent like a capable but gullible assistant, useful for low-stakes work, but never left alone with your most sensitive accounts. For broader protection habits, our cybersecurity and data privacy guide covers the fundamentals.
FAQ
Are AI browsers like Comet and ChatGPT Atlas safe to use?
They carry real, unresolved risks. Because they act with your logged-in access, a successful prompt-injection attack can reach sensitive accounts. They can be used relatively safely for low-stakes tasks if you limit permissions, use a separate profile without sensitive logins, and require confirmation for actions like sending email or making payments. Avoid them for banking or confidential data. Note that ChatGPT Atlas is being retired on August 9, 2026, with its features moving into the ChatGPT app and a Chrome extension.
What is prompt injection in simple terms?
Prompt injection is when hidden instructions inside a web page, email, or document trick an AI agent into doing something you did not ask for, like sharing your files or acting on a logged-in site. The instructions can be invisible to you, and the AI follows them because it cannot reliably tell your commands apart from malicious ones in the content it reads.
Can companies fix prompt injection?
Not fully, by their own admission. OpenAI has said prompt injection is unlikely to ever be completely solved, and the UK’s National Cyber Security Centre warned it may never be totally mitigated. Vendors reduce the risk with adversarial training, limits, and confirmation steps, but it remains a structural problem as long as agents read untrusted content with your credentials.
Which AI browser is the most secure?
No AI browser is fully secure against prompt injection, and independent testing shows all leading options block only a fraction of malicious pages. In one 2026 test, researchers tricked six different AI browsers into leaking credentials. Differences are in degree, not kind. Rather than relying on one product being safe, focus on how you use it: minimize access, separate sensitive logins, and keep a human confirmation step for any consequential action.
What should I do if I think my AI browser was compromised?
Stop the agent, disconnect its access to your accounts, and change passwords on anything it could reach, starting with email. Enable two-factor authentication where possible, review recent account activity for unauthorized actions, and check whether your email address has appeared in a known data breach. Treat it like any account compromise and act quickly.