If you run a small business on your own, an agentic browser sounds like the thing you have been waiting for. Not a browser that shows you a page, but one that reads it, summarizes it, fills in the form and buys the thing. I spent a week with the two that everyone named, Perplexity’s Comet and OpenAI’s ChatGPT Atlas. Then I spent a second week reading what security researchers found inside them, and then OpenAI shut Atlas down.<\/p>\n
This article is what I would tell a client: what one of these actually is, where it genuinely saves time, and the one risk that has not been solved yet. If the answer turns out to be “not for your client work”, the next question is how your AI gets to know your business instead, and that is what a knowledge base for AI is for. Business Brain, the seven-day course that builds you one, is where I send people who reach that point.<\/p>\n
An agentic browser is a web browser with a large language model built into it that can act on the page you are looking at, not just describe it. The category name is agentic because the model is allowed to take steps on your behalf: reading the open tab, clicking buttons, typing into fields, moving between sites. Its mechanism is simple and it is the whole story: it reads the page as text, decides what to do next, and does it using your own logged-in sessions. The result cuts both ways. A research task that took you twenty clicks can take one sentence. So can an instruction hidden on a page you did not write, on behalf of somebody else.<\/p>\n
Two things are called agentic browsers and only one of them is on your laptop. The one this article is about is a consumer browser you install and use yourself, like Comet or Atlas. The other is developer infrastructure: a headless browser driven by code, so that software can click through a site. That is what you have found if a search for the term returns automation platforms and GitHub repositories. People use the words AI browser loosely for both, and for an ordinary browser with an AI sidebar bolted on. That last one is a much smaller thing. A sidebar answers questions about the page. An agent acts on it.<\/p>\n
Traditional browsers such as Chrome, Safari and Firefox act as neutral windows onto the internet. They load pages, render text and images, and leave interpretation up to you. An AI browser goes further: it embeds large language models to understand content, generate answers and sometimes automate tasks. According to Gabb’s explainer on the difference between internet and AI browsers<\/a>, these new tools can summarize long articles, answer questions inside your browsing session and even complete multi-step workflows like shopping or booking travel. The search experience also changes: instead of a list of links you may receive an instant synthesized answer. For a busy solo business that sounds like time back, and it comes with trade-offs worth knowing before you install anything.<\/p>\n An in-depth comparison by c’t magazine (issue 22\/2025)<\/a> underscores this opportunity and risk. The editors tested seven browsers with AI helpers and concluded that built-in chatbots can simplify everyday browsing and even automate complete workflows, yet the technology is still error-prone and data protection must stay top of mind.<\/p>\n It summarizes what is in front of you, fills in forms and, on a good day, shops for you. Cybernews’ hands-on review of Comet<\/a> describes it as an AI-powered browser built on Chromium. Comet integrates Perplexity’s chat assistant into a familiar Chrome-like interface. It is free for anyone with a Perplexity account and supports Chrome extensions. What sets Comet apart is its ability to act on pages: the assistant can summarize content, fill out forms and even add items to your shopping basket. In one test, reviewers asked Comet to find cat food with the highest meat content and watched as it navigated a store, selected products and added them to a cart. Another standout feature is page summarization; clicking an icon prompts the assistant to generate a short summary without leaving the page. For a solo business researching market trends or comparing suppliers, this surfaces the key information fast.<\/p>\n Comet also includes a built-in ad and tracker blocker and supports cross-tab references via Comet promises to remember context, letting you pin results and recall snippets across sessions. In practice, memory recall is unreliable. During testing, the assistant failed to remember a previously added item until the user specified the shop. Automation is also limited: while it can handle simple tasks like filling forms or adding products to a basket, complex multi-site workflows often require manual intervention. These limitations mean you still need to supervise the AI, especially when real money or client data is involved.<\/p>\n It is free with a Perplexity account, and the free tier limits how much AI you can use in a day. In the c’t tests, Comet stood out for its deep integration with Perplexity’s answer engine. The free version includes an ad and tracker blocker and can export summaries to standard formats, but daily AI queries and uploads are capped. A paid tier includes more powerful models and cross-app connectors. Reviewers praised Comet’s chatbot and agentic features, yet found the interface confusing because so many functions hide behind menus.<\/p>\n On the plus side, Comet’s integration with Perplexity’s answer engine includes citations. When you ask a question, the browser can surface answers with sources, making it suitable for quick research. You can also import your Chrome bookmarks and extensions, which lowers the learning curve. For a free tool that is a lot, and the caveats are worth reading before you rely on it.<\/p>\n In the parts of the week that are research rather than judgment. If you spend hours gathering sources, writing briefs or scheduling meetings, one of these can take some of that off you. Four places where Comet earns its tab:<\/p>\n For a one-person business without research help, these features save real time and reduce the load of switching between tabs and tools. They are not a substitute for judgment. Complex requests still need carefully written prompts, and somebody still has to check the output.<\/p>\n No technology arrives finished, and these browsers are rougher than most. Comet reviewers noted performance hiccups and a significant learning curve, and memory features that fail without saying so. The privacy questions are the ones that need your own attention rather than mine. Comet has privacy settings, and what they do is a question for your own account rather than for this article. So the honest instruction is short. Open Perplexity’s current privacy page and your own settings, and read them on the day you need the answer, rather than trusting a summary written eleven months ago. Policies on this move faster than articles do, which is the reason this paragraph points you at the account instead of making a claim about it.<\/p>\n Even as a solo business, treat it as an experimental tool. Avoid using it on pages that contain client data, financial accounts or health information. Stick to public research and non-critical tasks, and clear or disable the browser’s memory regularly.<\/p>\n OpenAI shut it down. Atlas launched on 21 October 2025 as “a new web browser built with ChatGPT at its core”<\/a>, and that announcement page now carries a line above the text saying Atlas has since been deprecated. OpenAI’s own help article is plainer: “We’re deprecating Atlas and moving browser-based agentic capabilities into ChatGPT and Codex”<\/a>, with the browser “scheduled to stop working on August 9, 2026”. It lasted under ten months.<\/p>\n It is worth knowing what it did, because it is the clearest picture available of what this category is reaching for. Atlas summarized pages and answered questions on them, wrote in line so you could ask it to draft an email without leaving the tab. It kept an optional memories feature between sessions, and an early agent mode could click buttons and pull product data across several retailer sites. Reviewers found it strongest at long articles and structured data. The Washington Post’s review of 22 October 2025<\/a> found the privacy controls scattered across several screens and the memories feature separate from the history, so clearing one was not clearing the other.<\/p>\n That it is younger than the marketing suggests, and that is the limit to plan around. Atlas was not a side project. It came from the company whose model it ran on, launched with a livestream, and stopped working ten months later. Two weeks before this article was updated, The Browser Company announced that Arc will stop working on 22 December 2026<\/a> while the team moves to Dia, its AI-first replacement. Two of the four browsers the earlier version of this article described are now on their way out.<\/p>\n So the practical rule has nothing to do with features. Do not build a working habit on a browser that is one of several bets a company is placing, and do not put anything in one that you would struggle to get out. Export matters more than agent mode.<\/p>\n Most of them, in some form, and none of them has solved the hard part. Arc’s Max and its beta offshoot Dia include AI helpers, with the more capable automation behind a paid tier, and Arc itself stops working on 22 December 2026. Microsoft Edge’s Copilot is more conservative, and its multi-step agent was not reliable in testing. Brave, Opera and Google are all adding AI features of their own. Across the board, reviewers come back to the same requirement: strong guardrails before an agent is allowed to act on an untrusted page.<\/p>\n Prompt injection is an instruction hidden inside content the model reads, which the model then follows as though you had typed it. The OWASP Gen AI Security Project lists it first in its Top 10 for LLM Applications 2025<\/a>, as LLM01:2025, and separates the two shapes plainly: “Direct prompt injections occur when a user’s prompt input directly alters the behavior of the model”, while “Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.” An agentic browser lives on the second kind, because reading websites is its job.<\/p>\n Brave’s security team showed what that means in practice. In research published on 20 August 2025<\/a>, Artem Chaikin demonstrated instructions hidden in a web page that Comet carried out while summarizing it. He and Shivan Kaul Sahib wrote up why that is worse in a browser than in a chat window: “The AI operates with the user’s full privileges across authenticated sessions”, with banking, corporate systems, private email and cloud storage on the far side of those privileges. Their disclosure timeline is worth reading as a measure of how young this is. They reported the flaw to Perplexity on 25 July 2025, Perplexity shipped an initial fix on 27 July, retesting on 28 July found the fix incomplete, and the public disclosure followed on 20 August. An update Brave added to that post after publication says Perplexity still had not fully mitigated the attack class.<\/p>\n The whole category’s, according to the team that found it first. Two months later they went wider. In a second post on 21 October 2025<\/a> they wrote that “indirect prompt injection is not an isolated issue, but a systemic challenge facing the entire category of AI-powered browsers”, and named Comet and Fellou, adding Opera Neon in an update on 31 October. Separately, the LayerX team, whose research now sits on Akamai’s blog since the acquisition<\/a>, published the CometJacking attack on 4 October 2025 and put the consequence in one sentence: “The browser itself becomes a potential insider threat.”<\/p>\n Simon Willison, who has written about this attack class since it was named, put his own view on the record on 25 August 2025<\/a>, and I have not seen anybody refute it: “I strongly expect that the entire concept of an agentic browser extension is fatally flawed and cannot be built safely.” He uses the word extension, including about Comet itself. His reason applies either way: trusted instructions and untrusted page content reach the model as one stream of text, with nothing marking which is which.<\/p>\n An agentic browser will not reliably finish a job that crosses several sites, and that is the limit that matters most for work you are paid for. Comet handles one page well and loses the thread across many, and Atlas did the same before OpenAI withdrew it. Memory is unreliable in a specific, awkward way: it fails without an error message, so you find out by noticing a wrong answer rather than by seeing an error. Comet does not have the controls a regulated business needs, so role-based access and audit logs are simply absent. And the product itself may not last: Atlas ran for under ten months. Platform coverage is uneven and changing. And the open security question is not a bug waiting for a patch. It is a property of how these models read a page, which is why the researchers above say systemic rather than vulnerability.<\/p>\n There is also a limit on what this article can tell you. Every privacy and retention detail in these products has changed at least once since they launched, and will change again. What stays true is the shape of the risk and the questions to ask. The specifics belong in your own account, on the day you look.<\/p>\n Six things are settled enough to write down, and the seventh is the one nobody has solved.<\/p>\n For public research and first drafts, yes, and for anything involving a client, a payment or a login you care about, not yet. That is the whole answer, and the four reasons behind it are worth having in front of you.<\/p>\n My own setup is boring on purpose. The AI browser gets early-stage research, summaries and the first draft of an email. The traditional browser keeps the client folders, the invoicing and anything with a password I would mind losing. Agent mode stays off on any page involving money. If something feels off, I close the tab, and I have never regretted doing that.<\/p>\n It reads the page you have open and works on it. At the light end that means summarizing an article or answering a question about it without you leaving the tab. At the heavy end it means filling a form, comparing items across a shop and completing a checkout. The heavier the task, the more supervision it needs.<\/p>\n They are safe enough for public pages and not yet safe for anything behind a login you care about. The reason is specific: an agent acts with your own signed-in access, so an instruction hidden in a page it reads can reach whatever you are signed in to. Use them for research, keep them away from client data and banking, and turn agent mode off where money is involved.<\/p>\n Chrome has been adding AI features, and that is not the same as being an agentic browser. The dividing line is whether the assistant can take actions on the page on your behalf. Brave, Opera, Microsoft Edge and Google are all adding AI in some form, so the honest answer for any given browser is to check what its assistant is permitted to do rather than whether it has one.<\/p>\n One flaw matters more than the rest, and it is indirect prompt injection: instructions hidden in a page that the model carries out while reading it. Brave’s team called it a systemic challenge across the whole category on 21 October 2025. Everything else, from unreliable memory to confusing privacy controls, is an inconvenience by comparison.<\/p>\n Mostly, yes, and it is a different move. Instead of letting an agent work across your whole browser, you give the AI you already use, Claude or ChatGPT, a deliberate written description of your business and let it work from that. That is what a knowledge base for AI means, and it is what Business Brain, the \u20ac67 seven-day course, is built to produce.<\/p>\n A browser with a language model inside it that is allowed to act on the page you are looking at, using your own logged-in sessions, rather than only tell you what the page says.<\/p>\n I would install Comet, point it at public research only, and leave the client work where it is. What makes one of these useful is that it may act on whatever it reads, and that is the same thing that makes a hidden instruction dangerous.<\/p>\n The wish underneath this is simpler than a new browser. You want the AI you already pay for to know your business without you explaining it every time. It needs the knowledge base, written once and handed over on purpose.<\/p>\n If you want to see what yours knows right now, the Business Brain AI Audit<\/a> is free and takes one run. It reads what the AI can locate and use inside that one workspace during that one run. It does not read your other chats, it does not read your account memory or your connected tools, and it cannot prove that every file you uploaded was actually retrieved. The download is a zip containing an HTML file. If the result makes you want to build the thing properly, Business Brain<\/a> is the seven-day course it leads to: \u20ac67 once, four modules, in English, about an hour a day.<\/p>\nWhat does Comet actually do in a working day?<\/h2>\n
@tab<\/code> commands, though this feature still feels inconsistent.<\/p>\nWhat does Comet cost, and what is capped?<\/h3>\n
Where does Comet help a one-person business?<\/h3>\n
\n
Where does Comet fall short?<\/h3>\n
What happened to ChatGPT Atlas?<\/h2>\n
What does a shutdown tell you about the category?<\/h3>\n
Which other browsers are adding agents?<\/h2>\n
How does prompt injection work, and why does it matter here?<\/h2>\n
What did the security researchers actually find?<\/h3>\n
Is it one browser’s bug, or the whole category’s?<\/h3>\n
What are the limits worth knowing before you install one?<\/h2>\n
What is settled about these browsers, and what is not?<\/h2>\n
\n
So is one of these worth it for a solo business?<\/h2>\n
\n
What else do people ask about AI browsers?<\/h2>\n
What does an AI browser do?<\/h3>\n
Are AI browsers safe to use?<\/h3>\n
Is Chrome an AI browser?<\/h3>\n
What are the main security flaws in an AI browser?<\/h3>\n
Can I get the time saving without handing over my data?<\/h3>\n
What is an agentic browser, in one sentence?<\/h3>\n
What would I do with this today?<\/h2>\n