Should You Let an AI Agent Use Your Browser? What They Can Reach, and What Can Go Wrong

The pitch for an AI browser agent is that you describe an errand — find three quotes for van insurance, fill in this council form, book the cheapest train that gets in before ten — and it goes and does the clicking. This year that stopped being a demo. OpenAI, Anthropic, Perplexity and Google all ship one, and the question people are asking me is no longer "does it work" but "is it safe to let it near my accounts".

I have not run these agents against my own bank accounts, and I would not recommend you do either. What I have done is read what each vendor says its agent can reach, what it promises to ask before doing, and what the security researchers who have attacked them found. That turns out to be enough to make the decision.

Two designs, and why it matters where the agent runs

The products split into two kinds, and the split matters more than the brand.

The first kind runs in your browser. Claude in Chrome is an extension; Comet is a whole browser; Chrome's auto browse is built into Chrome itself. The agent sees what you see, and — this is the point — it is logged in to whatever you are logged in to. If your Gmail tab is open, the agent can read your email. If you stayed signed in to your bank, so is the agent.

The second kind runs in its own browser somewhere else. ChatGPT agent works in a virtual browser on OpenAI's side. It starts logged in to nothing. When it needs to sign in, it hands control to you — OpenAI calls this takeover mode — so that you type the password and the agent never sees it. The cost is convenience: it cannot use your existing sessions, saved cards or extensions.

Everything else about the safety of these tools follows from which side of that line they sit on.

What each one can reach, and when it asks

Agent	Where it runs	Who can use it	Asks before	Can you fence it in?
ChatGPT agent	OpenAI's virtual browser	Plus, Pro, Enterprise	Purchases and other consequential actions; pauses in watch mode on financial and email sites; takeover mode for logins	Indirectly — it has no access to your sessions to begin with
Claude in Chrome	Your Chrome, as an extension	Pro, Max, Team, Enterprise	Purchases and sharing personal data	Yes — site-level permissions; financial, adult and piracy sites blocked by default; admin allow-lists and block-lists
Perplexity Comet	Its own browser, on your machine	Free; paid tiers add background tasks	Less documented than the others	Only by what you choose to log in to
Gemini in Chrome (auto browse)	Your Chrome	Google AI Pro and Ultra, US desktop at launch	Purchases and logins	You can stop it at any point; limits are set per task

ChatGPT agent

OpenAI's design is the most conservative of the four. The agent is trained to ask for your permission before actions with real-world consequences, with a purchase as the example the company itself gives. On sites it classes as sensitive — the announcement names financial websites and email — it enters a watch mode that requires you to be actively supervising, and it stops taking the screenshots it otherwise uses to see the page. For anything that needs a login, takeover mode gives you the keyboard. The agent is on the paid plans only; free accounts do not see the option.

Claude in Chrome

Anthropic's extension is available on every paid Claude plan and asks for a lot of browser permissions: scripting to read pages, the debugger interface to click and type, plus tabs and downloads. The help page is unusually blunt about it — the extension is "enhanced with our safety classifiers but is still risky" — and Anthropic published the numbers behind that sentence. In its red-team testing, browser use without mitigations was successfully attacked 23.6% of the time; with its mitigations in autonomous mode that fell to 11.2%; a set of browser-specific tricks involving hidden form fields and URL manipulation went from 35.7% to zero. The defences are site-level permissions you control, mandatory confirmation before high-risk actions such as purchases or sharing personal data, and a default block on financial services, adult content and piracy sites. On Team and Enterprise plans an administrator can restrict the whole organisation to an allow-list.

Perplexity Comet

Comet is a full browser with Perplexity's assistant in a side panel that can summarise pages, answer questions and carry out tasks across sites. It launched in 2025 for top-tier subscribers and has been free for everyone since October of that year, on Windows, Mac and Android; the paid tiers add a background assistant that runs longer jobs while you do something else. It is the easiest of the four to start using and, for that reason, the one most people will try first.

It is also the one with the most public record of the failure mode. In August 2025 Brave's security team published a demonstration in which a Reddit comment containing hidden instructions, on a page the user simply asked Comet to summarise, caused the browser to visit the user's email, read a one-time code and send it out. In October Brave followed up with what it called unseeable injections: instructions in faint text on a coloured background, invisible to a person and perfectly legible to the agent's screenshot reader. Perplexity fixed the specific holes. The technique is general.

Gemini in Chrome

Google's auto browse arrived in Chrome on 28 January 2026 for Google AI Pro and Ultra subscribers on desktop in the United States, and at the time of writing I could not confirm UK availability. It handles multi-step chores — quotes, forms, subscriptions — with explicit approval required for purchases and logins, and you can stop it mid-task. Because it lives inside Chrome it has the same exposure as Claude's extension: whatever Chrome is signed in to, the agent can reach.

The problem none of them has solved

All four vendors, in their own words, describe a version of the same weakness. An agent reads pages as text and follows instructions in text, and it cannot reliably distinguish your instruction from one planted on a page. This is called indirect prompt injection, and it is different from the usual browser security worries because the attack does not need to break anything. It just needs to be read.

The state of play in 2026 is not encouraging. At Black Hat USA this summer a Brave engineer presented an analysis of the major AI browsers and reported that every one he examined was vulnerable to prompt injection in some form, despite multiple layers of guardrails. Anthropic's own published figure — 11.2% with defences on — is a vendor telling you that roughly one determined attempt in nine still succeeds. OpenAI's approach of keeping the agent out of your sessions altogether does not stop injection either; it limits what an injected instruction can steal.

That last point is the one to hold on to. You cannot make the agent immune. You can decide what it has access to when it is fooled.

How to use one without regretting it

1. Give it its own browser profile. Chrome, Edge and Firefox all support profiles; create one for the agent and log in to nothing there except what the task needs. If you are choosing a browser anyway, my comparison of browsers after Arc covers which ones handle profiles well.
2. Never leave it signed in to email. Email is the master key to everything else, because it is where the password resets go. Brave's Comet demonstration went straight for the inbox for exactly that reason.
3. Keep every confirmation on, and read the payment ones. The prompts are irritating within an hour. They are also the only line between "the agent was fooled" and "the agent was fooled and spent money".
4. Prefer the agents that let you draw a fence. A site allow-list is worth more than any model improvement, because it does not depend on the model noticing the attack.
5. Give it the right jobs. Research, comparison, form-filling you will check before submitting, collecting quotes. Anything where the worst outcome is a wasted ten minutes. I cover the research side, and how much to trust an AI's citations, in my piece on AI research tools and your sources.

What I would pick

• You want to try the category and see whether it saves you time: Comet, in a fresh profile logged in to nothing. It is free and it is capable, and the constraints above make its history less alarming.
• You already pay for ChatGPT and the task involves any site with your money on it: ChatGPT agent. Its separate-browser design and takeover mode are the closest thing to a safe default.
• You already pay for Claude, or you are rolling this out to a team: Claude in Chrome, for the allow-list. Being able to say "this agent may visit these six sites and nothing else" is the control I would want before letting staff use one. If you are still deciding between the assistants themselves, my comparison of the paid plans is the place to start.
• You are in the UK and were hoping for Chrome's built-in version: wait. Check Google's availability page rather than a third-party guide, because the rollout has been US-first and subscription-gated.

The honest summary is that these tools are further along than their safety is, and the vendors say so themselves if you read past the launch video. Use one where being wrong is cheap. Keep it out of the browser where being wrong is not.