OpenAI wrote in a December 22, 2025 blog post that prompt injection, in which hidden instructions on a web page or in an email manipulate an AI agent, is “unlikely to ever be fully ‘solved'”, as reported by TechCrunch. That sentence comes from the company that builds one of the best-known AI browsers, and it frames the whole category: these tools can do real work for you, and they can also be tricked into doing the wrong work.
This guide explains what AI browser agents are, what they can do today, where tests and hands-on reviews show them failing, how prompt injection works, and a set of rules for using them safely. It draws on reporting and testing by TechCrunch, Consumer Reports, Android Authority and the MIT AI Agent Index.
What Are AI Browser Agents?
Consumer Reports describes ChatGPT Atlas, Perplexity Comet and Microsoft Edge’s Copilot Mode as Chromium-based browsers with built-in AI agents. Instead of only answering questions, the agents can act for you, such as booking a table, comparing products or reading your email.
The MIT AI Agent Index describes Atlas agent mode as working inside the browser, with a sidebar showing the agent’s action trace, a chatbox for prompting it, and the ability for the user to take over, hand control back and steer it. It lists the advertised uses as researching and analysing, automating tasks, and planning events or booking appointments.
| Item | Chatbot | AI browser agent |
|---|---|---|
| What it does | Answers in a chat window | Clicks, types and navigates pages for you |
| Access | What you paste in | Pages you are logged in to |
| Risk | Wrong answers | Wrong answers plus wrong actions |
| Control | You copy and act | It can proceed and ask for confirmation |
If you want the wider picture of agents beyond the browser, see our explainer on agentic AI for business. For how teams chain agent steps together, see our guide to agentic AI workflows.
What AI Browser Agents Can Do Today
| Task | What testers and documentation report |
|---|---|
| Research and summaries | Consumer Reports found Atlas produced an accurate laptop comparison table in about 2 minutes |
| Email summaries | Comet was fastest at about 40 seconds after connecting to Gmail, while Atlas was accurate but took about 2.5 minutes |
| Restaurant booking | Atlas finished in about 90 seconds in Consumer Reports’ test |
| Shopping | Android Authority found Atlas shopping only added items to a Walmart cart at the time of its hands-on |
| Browser housekeeping | Android Authority found non-agent commands such as closing shopping tabs and starting a timer worked well |
These are snapshots from specific tests, and products update often, so treat the results as a guide to the kind of task agents handle, not as a guarantee.
Where AI Browser Agents Fail
Slow and Inconsistent Results
Consumer Reports found the tools were often clunky, sometimes slower than doing tasks manually and occasionally error-prone. In one test Comet first searched the wrong location and took nearly 3 minutes to book a table, and in a laptop comparison its results were inconsistent enough that the reviewer had to verify them. Copilot Mode took about 6.5 minutes on the laptop comparison.
Confirmations That Do Not Match Reality
Android Authority reported that Atlas confirmed a restaurant booking and offered a reminder, but no reservation existed, and described agent mode as a cautious intern that needs close supervision. The reviewer said it rarely worked in their experience and that ChatGPT’s hallucination problem still affects Atlas. Our explainer on AI hallucinations covers why this happens.
Limits by Design
The MIT AI Agent Index lists agent-mode limits in Atlas: it cannot run code in the browser, download files or install extensions, cannot access the file system or other apps and cannot access saved passwords or autofill data. User input is required for certain tasks such as checking out a cart. It also notes agent mode is in preview and was available only on paid tiers.
The Prompt Injection Problem
TechCrunch reported that OpenAI said agent mode in Atlas expands the security threat surface, and that it trained an automated attacker to test defences. In a demonstration, a malicious email caused an agent to send a resignation message instead of an out-of-office reply, and after a security update agent mode detected the attack and flagged it. OpenAI declined to say whether the update measurably reduced successful injections.
| Voice | What was said |
|---|---|
| OpenAI | Prompt injection is unlikely to ever be fully solved and is a long-term security challenge |
| UK National Cyber Security Centre (December 2025) | Prompt injection attacks against generative AI may never be totally mitigated; reduce risk and impact |
| Consumer Reports | Brave researchers showed hidden instructions in a web page comment could make Comet access a logged-in Gmail tab |
| Wiz researcher Rami McCarthy | Risk is autonomy multiplied by access; value does not yet justify the risk for most everyday uses |
For a wider look at how attackers use AI against ordinary users, see our guide to AI-driven phishing attacks.
How to Use AI Browser Agents Safely
Both OpenAI and Consumer Reports give similar advice, and it is worth following.
| Rule | Why |
|---|---|
| Log out of email, banking and social media while the agent works | Limits what a hijacked agent can reach |
| Require confirmation for sending messages and making payments | Stops silent harmful actions |
| Give specific instructions, not broad access | OpenAI says wide latitude makes it easier for hidden content to influence the agent |
| Do not use it for banking or sensitive documents | One reviewer would not trust it with these |
| Check the results | Agents can misread requests and hallucinate |
| Keep trusted apps for important tasks | Consumer Reports found the OpenTable app as easy or faster than the agent |
Use a password manager for your accounts and keep agent sessions separate. Our comparison of the best password managers for 2026 can help you choose one. The cybersecurity guide for remote work covers wider habits.
Should You Use One?
Consumer Reports concluded that most people should not rely on AI browsers yet and should treat them as beta products, not replacements for their current browser. Wiz researcher Rami McCarthy told TechCrunch that agentic browsers’ current value does not yet justify their risk for most everyday uses. If you are curious, try a low-stakes task such as comparing public product pages, and keep your important accounts out of the session.
