The honest answer is: it depends on what you're about to let it do, and most of the people building these tools haven't made that easy to judge yet. ChatGPT Atlas, Perplexity's Comet, Opera Neon and the agent features now built into Chrome and Edge can read a page, fill out a form, click through a checkout and act on instructions buried in whatever they're looking at -- including instructions that aren't yours. Three real disclosures from the past year, plus a federal court ruling, give you a way to check before you hand one real access.
What makes an agent different from a browser tab
The core risk isn't that these tools read pages -- every browser does that. It's that an agent can act on what it reads, using your already-logged-in session, without asking first every time. That distinction turned out to matter legally as well as technically: in Amazon.com Services v. Perplexity AI, decided Aug. 4, 2026, the Ninth Circuit vacated Amazon's injunction against Perplexity's Comet because Comet runs locally on the user's own machine -- taking screenshots of what the browser shows and sending instructions back, without Perplexity's own servers ever talking to Amazon's directly. The court explicitly left open whether an agent with "greater control," where the company's own servers talk to the target site directly, would be treated the same way -- the practical fallout played out six weeks later, when Amazon blocked a cloud-hosted rival agent built the opposite way. Whether your agent runs on your machine or on the vendor's servers changes who is legally "accessing" the site on the other end, and what the vendor itself can see and log along the way.
Three disclosures that show what actually goes wrong
Brave's own security team showed how little it takes. In an Aug. 20, 2025 disclosure, researchers Artem Chaikin and Shivan Kaul Sahib demonstrated that a single Reddit comment, with instructions hidden inside a spoiler tag, could hijack Comet: a user clicking the browser's own "Summarize" button was enough for the agent to read the hidden text as a command, pull the user's email address from their Perplexity account, request a one-time passcode, retrieve it from the user's already-logged-in Gmail tab, and post both back to the same Reddit thread -- entirely within the page-summarizing task the user actually asked for. Brave reported the flaw privately on July 25, 2025; Perplexity's first fix, shipped two days later, turned out to be incomplete on retest.
A separate disclosure a year later showed the hijack doesn't even need a hostile webpage. Security researcher Gal Weizman's BragJack technique, published Sept. 16, 2026, used one already-installed, unrelated browser extension to feed a complete attacker-written prompt straight to the built-in AI agents in Chrome, Edge, Comet, Opera Neon and Claude for Chrome at once -- reaching local files, camera, microphone and screenshots with zero further clicks in some cases. The full technical breakdown is here. Google and Microsoft shipped fixes and assigned CVEs; Opera disputes how the flaw in its browser was found, and no vendor has reported a confirmed real-world victim as of publication.
Independent testing also shows a real gap between vendors, not just between "AI browsers" and ordinary ones. Security firm LayerX ran 103 real, in-the-wild phishing and malicious pages against ChatGPT Atlas on Oct. 27, 2025 and found it blocked just 5.8% of them -- compared with 47% for Chrome and 53% for Edge running their own built-in protections. Testing three other agentic browsers (Comet, Dia and Genspark) against the same attack set, LayerX found they blocked roughly 7% on average. None of the agent-equipped browsers came close to the traditional pair.
Real-world phishing pages blocked, by browser
None of this means skip agentic browsing -- it means check the specific agent in front of you before it touches anything that matters. Here's the five-minute version.
Check an AI browser agent before you let it act for you
- Perplexity's Comet runs locally, taking screenshots of what your browser shows; most enterprise-hosted agents run on the vendor's own servers with your stored login. The Ninth Circuit's Aug. 2026 ruling treats these differently under federal computer-fraud law, and it usually tells you how much the vendor itself can see and log.
- Most agentic browsers ship with some version of a faster, less-confirmed default mode alongside a stricter 'ask before every action' setting.
- Google and Microsoft each shipped a fix and a CVE number for the BragJack flaw in their AI agents within weeks; Opera disputed how its own flaw was found rather than confirming a fix timeline. A vendor's pattern of actually patching and disclosing matters more than its stated principles.
- Brave's Comet demonstration specifically used the agent's standing access to a logged-in Gmail tab to retrieve a one-time passcode -- the risk wasn't a separate email hack, it was the agent's browser session already being logged in.
- A task like summarizing an article or comparing two product pages shows you how the agent actually behaves -- what it asks permission for, what it does silently -- without real exposure if something goes wrong.
Step two above -- what it's allowed to do without asking -- is really a scoping decision, and it looks different depending on the task.
How much should this specific agent be allowed to do?
The same handful of mistakes show up across all three disclosures above.
Four ways this gets skipped
None of this is an argument that agentic browsers are uniquely broken -- it's an argument for treating their permissions the same way you'd treat handing an AI agent standing access to your email and calendar: scope it narrow, confirm what it actually touches, and don't assume an extension that isn't labeled 'AI' is automatically safer to leave running next to one that is -- BragJack worked through an entirely ordinary one.
- ChatGPT Atlas blocked just 5.8% of real phishing pages in independent testing, versus 47-53% for Chrome, Edge.
- Brave showed Comet could be tricked into emailing a stranger your email address and login code.
- BragJack showed one ordinary browser extension could hijack five browsers' built-in AI agents at once.
- A federal appeals court treats agents that run locally very differently from ones hosted in the cloud.
- No vendor has solved prompt injection yet; scope what the agent can touch instead of trusting it.