What is an agentic browser?

An agentic browser is a web browser, or an extension added to an existing browser, equipped with an AI agent that can navigate websites, click, fill in forms, make purchases and complete tasks on the user's behalf autonomously, instead of simply answering questions inside a chat window. Well-known examples are OpenAI's ChatGPT Atlas, Perplexity Comet, Anthropic's Claude for Chrome extension and Genspark. Unlike a chatbot, which only reads and writes text, an agentic browser operates inside real authenticated sessions: it has access to cookies, saved credentials and the ability to execute actions with concrete effects on the world, such as sending a payment or posting a message. This makes it extraordinarily useful for automating repetitive web tasks, but it also opens up a new attack surface: a malicious site can hide instructions meant for the agent, not for the human user, and hijack its behavior by exploiting those very same credentials.

See also: AI Agents (Agentic AI) · AI systems that go beyond answering: they plan, use tools and take actions autonomously inside your processes.

The specific security risk

This real access opens up a far more dangerous version of prompt injection, where malicious instructions hidden in a web page, not written by the user, can hijack the agent toward unwanted actions: transferring data, making purchases, sending messages, exploiting the user's own credentials and sessions. A University of Washington study published in late June 2026 tested seven agentic browsers and found preconditions for bypassing the same-origin policy, the mechanism that isolates sites open in the same browser, in three of them plus Chrome with Gemini, then demonstrating a working attack on ChatGPT Atlas where one site stole information from another site embedded inside it.

Enterprise adoption and early corporate limits

According to Cyberhaven Labs, by October 2025 about 27.7% of enterprises already had at least one employee who had downloaded ChatGPT Atlas, with adoption reaching as high as 10% of the workforce in some organizations. Facing this risk, many companies have started restricting agentic browser use to explicitly approved and monitored tools, instead of leaving adoption unmanaged on corporate devices.

A "20 years back" moment for web security

A Dark Reading article described agentic browsers as rewinding web security by twenty years: to let the agent move across different domains and carry out tasks on the user's behalf, these browsers remove or loosen isolation mechanisms, the same-origin policy, separation between contexts, that the web had built over time specifically to protect human users. Reopening those protections for an agent that interprets a page's content means reintroducing vulnerability classes long considered solved.

Why it matters for a business

Before authorizing the use of an agentic browser inside a company, it should be treated as an identity and access management problem, not a simple productivity tool: as with AI agents in general, you need to define precisely which sessions and credentials the agent can use and under what limits, and design the same defense in depth built for prompt injection, least privilege, human confirmation on irreversible actions, monitoring, from day one, not after the first incident.