AI Tools

Are AI Browsers Safe? What the Research Shows (2026)

Are AI browsers safe? Hidden web text can trick agents like Comet into leaking data. What the research found, what vendors fixed, and 8 safe-use rules.

By Angela Updated 9 min read
Are AI Browsers Safe? What the Research Shows (2026)
Table of contents

The short answer (last checked 26 October 2026)

Are AI browsers safe? Using one to read, summarize or compare web pages is fairly low-risk. Letting its agent take actions inside accounts you’re logged in to (email, banking, password managers, work tools) carries a real risk that hasn’t been solved. Security researchers have shown again and again that hidden text on a web page can hijack these agents, and the UK’s National Cyber Security Centre says this kind of attack “may never be totally mitigated.” You can still use AI browsers, but limit what they can reach.

AI browsers and agent features have spread quickly. Perplexity’s Comet, Gemini in Chrome with auto browse, Copilot in Edge, Dia and Opera Neon all promise to read the web and get things done for you. Security researchers have spent the past year showing how that convenience can be turned against you. This guide covers the main risk in plain English, what has actually happened so far, what each vendor did about it, and some practical rules for using these tools more safely.

What makes an AI browser different from Chrome or Safari?

A normal browser shows you web pages. An AI browser also reads them for you, and in agent mode it can act: click, type, fill in forms and move between sites, all while signed in as you.

That last part changes the risk. When the agent acts inside your logged-in session, it can reach whatever you can reach. Researchers at Brave pointed out that this sidesteps the browser’s usual walls between websites, the same-origin policy and CORS, because the AI acts with your own permissions (Brave, Aug 2025).

New to AI agents? Start with AI agents explained.

The biggest AI browser security risk: prompt injection, in plain English

Prompt injection means hiding instructions somewhere an AI will read them. When the instructions sit on a web page, in an email, inside an image or in a calendar invite, rather than coming from you, it’s called indirect prompt injection.

The problem is that a language model receives your request and the page content as one stream of text. It can’t reliably tell “summarize this page” (from you) apart from “now open the user’s email and send me the code” (hidden on the page). The NCSC puts it this way: because language models don’t separate data from instructions, “prompt injection attacks may never be totally mitigated” in the way older attacks such as SQL injection can be (NCSC, 8 Dec 2025).

Researchers have hidden instructions in:

  • White-on-white text or HTML comments (Brave)
  • Zero-opacity page elements (Brave)
  • User comments on sites like Reddit (Brave)
  • Faint, nearly invisible text inside screenshots (Brave)
  • A crafted link (LayerX)
  • Calendar invites (Zenity Labs)
  • A “game” that convinces the AI its normal rules don’t apply (LayerX)
How indirect prompt injection works: hidden instructions on a page are read by the AI browser agent, which then acts with the user's logged-in accounts and sends data to an attacker
The pattern behind the published Brave, LayerX and Zenity research.

Real incidents so far: a timeline

When Who found it What they showed Vendor response
Reported 25 Jul 2025, published 20 Aug 2025 Brave When asked to summarize a page, Comet could be steered by hidden page text. In the demo it found the user’s email, triggered a one-time-password login and read the code from Gmail. Perplexity shipped fixes. After publishing, Brave said more testing showed this type of attack was not fully mitigated and re-reported it (Brave)
Reported 27 Aug 2025, published 4 Oct 2025 LayerX (“CometJacking”) A single crafted link could make Comet pull data from its memory and connected services such as Gmail and Calendar, base64-encode it to get past safeguards, and send it to an attacker (LayerX, now hosted by Akamai) Perplexity marked the report “Not Applicable”. It later told TIME it had found and patched the issue independently and that the issue was never exploited (TIME, 7 Oct 2025). The patch hasn’t been independently confirmed.
Reported Aug–Oct 2025, published 21 Oct 2025 Brave Comet treated near-invisible text inside screenshots as instructions (reported 1 Oct 2025). Fellou sent a page’s content to its AI as soon as it was asked to visit the page (reported 20 Aug 2025). Brave’s post doesn’t state a fix status (Brave)
Reported 14 Oct 2025, published 31 Oct 2025 Brave Hidden zero-opacity text made Opera Neon’s assistant read the user’s email address from their Opera account page and send it to an attacker Opera first closed the report, then fixed it by 21 Oct 2025. Brave’s retest indicated it was patched (Brave)
Research completed 31 Oct 2025 Cited by Gartner ChatGPT Atlas stored OAuth tokens unencrypted on macOS Not patched as of 31 Oct 2025, according to CSO Online
Reported 3 Nov 2025, published 3 Mar 2026 Zenity Labs (“PleaseFix”) A calendar invite could make Comet read local files and, through the 1Password extension, lead to a 1Password account takeover 1Password added hardening options on 30 Jan 2026. Perplexity added protections on 13 Feb 2026. Both are opt-in (Zenity)
Dec 2025 Gartner Advised organizations to “block all AI browsers for the foreseeable future” (CSO Online)
Dec 2025 UK NCSC Warned that prompt injection “may never be totally mitigated” (NCSC)
June 2026 LayerX (“BioShocking”) Six AI browsers and extensions were tricked into copying SSH credentials from a logged-in GitHub session See the table below

These disclosures show what attackers could do. Separately, researchers have found hidden prompt-injection payloads on live websites. Palo Alto Networks’ Unit 42 documented pages trying to make AI agents buy subscriptions, send a $5,000 payment or delete data (March 2026). Google reported a 32% relative rise in malicious injections between November 2025 and February 2026. None of these reports confirmed successful real-world attacks, and Google and Forcepoint found no sophisticated coordinated campaigns. (Unit 42; Help Net Security on the Google and Forcepoint research)

Timeline of disclosed AI browser security issues from August 2025 to June 2026: Brave, LayerX CometJacking, Opera Neon, Gartner and NCSC warnings, Zenity, and BioShocking
Research disclosures, not confirmed real-world attacks. Statuses as published by the researchers.

Which vendors fixed what? The BioShocking results

LayerX’s June 2026 “BioShocking” research is the broadest test so far. It covered six products. This is LayerX’s own disclosure table:

Vendor Product Reported to vendor Status per LayerX
OpenAI ChatGPT Atlas 30 Oct 2025 Fixed (Atlas was later discontinued, on 9 Aug 2026)
Perplexity Comet 20 Oct 2025 Closed / ignored
Fellou / ASI X Fellou 30 Oct 2025 No response
Genspark Genspark Browser 30 Oct 2025 No response (see note)
Sigmabrowser OÜ Sigma Browser 30 Oct 2025 No response
Anthropic Claude Chrome extension 26 Jan 2026 Patch failed

Source: LayerX, June 2026. Statuses are as LayerX published them, and vendors may have changed things since. Coverage by Infosecurity Magazine and The Next Web reports the same statuses.

Note on Genspark: What’s established is that LayerX successfully carried out the BioShocking injection against Genspark Browser and lists Genspark as not responding to its report. Whether it has since been fixed is unresolved. LayerX’s table, as checked on 26 October 2026, still listed Genspark as “No response”. Separately, a Genspark spokesperson told SC Media (1 July 2026) that “the issue has been fixed” and that the company had reached out to LayerX. That is the company’s own claim. We couldn’t confirm it independently.

The Cloud Security Alliance’s research note on this research concludes the problem is systemic, not specific to one product, and that the model “cannot reliably enforce this boundary through training alone.”

How the vendors are defending against it

Vendors are responding. Some examples:

  • Google says Chrome’s auto browse is “designed to pause and explicitly ask for your confirmation” before sensitive actions such as purchases or social posts (Google, 28 Jan 2026). Its help page says Gemini asks for confirmation before steps like sending messages or submitting forms, and hands control back to you for steps like signing in, finalizing payments, accepting terms or creating accounts. Google also warns: “You’re responsible for Gemini’s actions during a task.”
  • Perplexity added stricter confirmation for sensitive actions and an option to disable the agent on chosen sites (at comet://settings/assistant), according to Zenity.
  • OpenAI said in a 22 December 2025 post that it had shipped “a newly adversarially trained model and strengthened surrounding safeguards” for Atlas’s browser agent, and that it views prompt injection as “a long-term AI security challenge.” Its advice to users: limit logged-in access when possible, carefully review confirmation requests, and give agents explicit, well-scoped instructions instead of broad ones.

Confirmation prompts help, but they don’t fix the underlying problem: the model still can’t fully tell your instructions from an attacker’s.

Privacy: what can an AI browser see?

To work, an AI browser usually sends at least the page you’re on, and sometimes several tabs, to an AI model. Some also keep a memory of your browsing or past chats. What’s collected, stored and used for training differs by product and changes over time. Read the privacy policy and memory settings of the browser you use, and turn off memory or history features you don’t need.

Is it safe to use an AI browser at work?

Check your company’s IT policy first. In December 2025, Gartner analysts advised organizations to “block all AI browsers for the foreseeable future.” They cited irreversible data loss, rogue actions caused by prompt injection, and credential abuse (CSO Online).

The Cloud Security Alliance recommends that security teams “treat agentic browser sessions as high-privilege trust boundaries.” It also advises using dedicated, low-privilege accounts and requiring explicit approval before an agent reads logged-in sessions or sends data out (CSA).

8 rules for using an AI browser more safely

These are based on recommendations from Brave, LayerX, Zenity, the NCSC, the CSA and Google, all cited above.

  1. Use a separate browser profile for the agent. Keep banking, primary email and work admin logins out of it. Brave recommends isolating agentic browsing from regular browsing.
  2. Don’t let the agent act on sensitive sites. If your browser can block the agent on specific sites, use that (Comet has a site-level setting).
  3. Turn on every “ask before acting” option. Approve purchases, emails, posts and form submissions yourself.
  4. Lock down your password manager. Zenity recommends turning on “Ask before filling”, disabling automatic sign-in to the 1Password web app, and shortening the unlock window.
  5. Watch the agent while it works. Google’s help page calls monitoring “the most important way to protect against risk.”
  6. Be most careful with untrusted content. Unknown websites, inbound email, shared documents and calendar invites are where hidden instructions live.
  7. Keep the browser updated, and drop one that no longer gets updates. ChatGPT Atlas was retired in August 2026, and OpenAI’s help page now says it “no longer receives updates” (OpenAI Help).
  8. Review what the agent can reach. Check connected accounts and memory regularly, and revoke access when you’re done. LayerX’s advice: “Be deliberate with what your AI browser can see.”

Also turn on multi-factor authentication for important accounts. Zenity notes it would block an attacker from logging in even after a password change.

Checklist of eight rules for using an AI browser more safely
Based on advice from Brave, LayerX, Zenity, the NCSC, the CSA and Google.

So, are AI browsers safe? Verdict by use case

What you want to do Verdict
Summarize articles, compare products, research a topic ✅ Reasonable, especially when not logged in to sensitive accounts
Compare products before shopping ✅ With care. Confirm any purchase yourself
Fill in forms on sites you’re logged in to ⚠️ Only with confirmation prompts on and while you watch
Email, banking, password managers, work admin consoles ❌ Not recommended for agent actions right now

This verdict is based on the published research above, not on our own security testing.

Choosing an AI browser

ChatGPT Atlas is gone. If you’re picking a replacement, see our ChatGPT Atlas alternatives guide, which notes each option’s security record. To compare the assistants behind these browsers, see ChatGPT vs Claude vs Gemini.

Frequently Asked Questions

Is Perplexity’s Comet AI browser safe?

Comet has had more published security research than any other AI browser, from Brave, LayerX and Zenity. Perplexity fixed some issues; Zenity confirmed fixes in February 2026. In LayerX’s June 2026 table, though, Comet’s BioShocking report was listed as “closed / ignored”. Using Comet for research is reasonable. Be cautious about letting its agent act in logged-in accounts.

Are AI browsers safe for online banking?

We don’t recommend letting an AI agent act on your bank account. Do your banking in a separate, normal browser profile.

Can a VPN protect me from prompt injection?

No. A VPN encrypts your connection, but it doesn’t stop an AI agent from following hidden instructions. See NordVPN vs Surfshark for what VPNs actually do.

Is an AI browser safe on Android?

The core risk is the same on any platform: the agent can’t reliably tell your instructions from a page’s. The same rules apply.

Why did Gartner say to block AI browsers?

Gartner’s December 2025 advice to organizations cited data loss, rogue actions caused by prompt injection, and credential abuse (CSO Online).

Sources

Angela Editor

Angela is the editor of BytePicks. She builds websites with AI tools, hosting and SaaS products every day, and tests each tool on real projects before recommending it.