A new kind of browser has arrived, and it does not just show you the web. It acts on it. Ask it to book a table, compare three suppliers, or clear out your inbox, and it will click through the pages and do the work while you watch. The convenience is real. So is the reason AI browser security has quietly become one of the sharpest questions in tech this year.
For a small business owner, the pitch is easy to like. Fewer tabs, fewer manual steps, a helper that handles the busywork. It is worth sitting with the other half of that picture before handing over the keys.
What an agentic browser actually does
OpenAI launched its Atlas browser in October 2025, with an Agent Mode that carries out multi-step tasks on its own. Perplexity launched Comet, a research-first AI browser, in July 2025. The key difference from a normal browser is that these agents work inside your logged-in sessions. When they act, they act as you, with whatever access you already have open. HumanSecurity reported a 6,900 percent increase in web requests coming from AI agents and agentic browsers since July 2025, which gives a sense of how fast this shifted from novelty to normal.
The flaw researchers keep running into with AI browser security
In a study published on June 30, 2026, a University of Washington team tested seven agentic browsers and found that four of them, including ChatGPT Atlas, Chrome with Gemini, Claude for Chrome and Perplexity Comet, created ways to bypass the same-origin policy. That policy is the rule that keeps one website from reading another’s data, and it has underpinned safe browsing for roughly three decades. The researchers describe the weakness as a meaningful regression in browser security.
They found two main attack routes. One is prompt injection, where hidden instructions buried in a malicious web page hijack what the agent does. The other is memory poisoning, where an agent’s stored information gets contaminated across different sites. In a proof of concept on Atlas, one website was able to pull sensitive information out of another embedded inside it.
Why it may not simply get patched away
The uncomfortable part is that this is not a bug with an obvious fix. OpenAI itself wrote in December 2025 that prompt injection is unlikely to ever be fully solved. The problem is structural. An agent reading a page cannot always tell the difference between a genuine instruction from its owner and a hostile one smuggled into the content it is reading. Security researchers have said the same across Atlas, Comet and other tools. That does not make these browsers useless. It makes them tools that need boundaries.
What this means for a small business
Two things are true at once here. An agent that clears repetitive web work can genuinely save hours. And that same agent may be holding your email, your calendar and your saved payment methods in a session it can be tricked into misusing. The sensible response is not fear, and it is not blind trust. It is narrow scope.
One small, practical step: keep an agentic browser away from your most sensitive logged-in sessions, especially banking and primary email, and let it handle lower-stakes research or drafting where a human still reviews the result. The same discipline that makes AI agents inside everyday software useful, a narrow job and a human check, applies here too. It matters even more as agents begin to shop and transact on their own.
The convenience is going to keep improving, and most people will end up using some version of this. The open question is a governance one, not a technical one: who decides what an agent is allowed to touch, and how much of that decision a busy owner is willing to make on purpose rather than by default.
