Level : Intermediate
AI browser agents: when AI uses the web for you
By The Info Agent IA editorial team ·
An AI browser agent is an assistant that uses the web the way you would: it opens pages, clicks, fills in fields and chains steps together until it reaches the result you asked for. It saves real time on repetitive chores, but it also exposes you to a new risk, prompt injection, which means you need to stay in control of anything that touches your money or your accounts.
From an assistant that reads to an agent that acts
For a few years now, many browsers have offered an assistant in a side panel. You ask it to summarise an article, explain a contract or compare two product pages open in different tabs. It reads and it answers, but you are the one doing the clicking.
An AI browser goes further when it offers an agent mode. You hand it a mission (“find me a Saturday morning slot with a physiotherapist near my home”) and it browses on its own. At that point it becomes a genuine AI agent: it receives a goal, picks its actions and checks the outcome. If the idea is still fuzzy, our guide what is an AI agent explains it in plain terms.
Technically, this falls under computer use, a model’s ability to operate an interface designed for humans: screen, cursor, keyboard. Inside a browser, the agent reads the page structure or a screenshot, finds the right button, acts, then looks at what changed.
The idea is not new. Anthropic introduced computer use on 22 October 2024, as a public beta with Claude 3.5 Sonnet. The model works in a loop (screenshot, action, new screenshot), and Anthropic was already advising developers to run it in an environment with minimal privileges and under human supervision. Agentic browsers then built the same principle straight into the tool you use every day.
How the agent works, step by step
Take a simple request: “Compare the price of this vacuum cleaner on three sites and put the cheapest one in my basket.” A browser agent roughly follows this loop:
- It breaks down the mission: find the exact model, open three shops, note prices and delivery costs.
- It acts: it types into search boxes, opens product pages, scrolls.
- It observes: after each click, it re-reads the page to check it is in the right place.
- It adjusts: a cookie banner, an out-of-stock page or an error forces it to change plan.
- It stops before the sensitive step, in principle: it shows you the basket and lets you pay.
This “observe, decide, act” loop is shared by every agent. We cover it in detail in how an AI agent makes decisions.
Check yourself A browser agent re-reads the page after every click. Why is that essential?
Because it cannot know in advance what the site will display. A pop-up, a sold-out product or a layout change can make its plan useless. Re-reading the page lets it see the real effect of its action and correct course instead of clicking blindly.
The main browser agents in October 2026
The landscape has shifted a lot in a year. Here are the active offers listed on publishers’ websites as of 22 October 2026.
- Comet, from Perplexity, is a Chromium-based browser that has been free for everyone since 2 October 2025. Its agent, Comet Assistant, browses and fills in forms. According to Perplexity’s help centre, its agent requests are not included in the free plan.
- Opera Neon is built around three tools: Neon Chat, Neon Do (the agent that browses) and Neon Make (which produces content and code). Neon Do shows its planned steps and you can pause it. The agents require the Standard subscription, and the browser runs on Windows and macOS.
- Brave Leo, the assistant in the Brave browser, puts privacy first. Its agentic browsing feature, “AI browsing”, is still being tested: you switch it on manually in the experimental settings and it runs in a profile kept apart from your everyday browsing.
- Extensions: Anthropic offers “Claude in Chrome”, limited to paid Claude plans. On OpenAI’s side, ChatGPT Atlas has been retired; agentic browsing now goes through the ChatGPT desktop app, Codex and a Chrome extension.
The table below shows the plans and capabilities declared by the publishers:
| Assistant | Free | Paid from | Web search | Agent mode | Voice | Images |
|---|---|---|---|---|---|---|
| Comet | Limited | $17/mo | Yes | Yes | — | — |
| Opera Neon | Limited | $19.9/mo | Yes | Yes | — | Yes |
| Brave Leo | Limited | $14.99/mo | Yes | Yes | Yes | — |
| Genspark | Limited | $24.99/mo | Yes | Yes | Yes | Yes |
| Tool | Form | Browsing agent | Watch out for |
|---|---|---|---|
| Comet | Full browser | Yes, for subscribers | Acts with your open sessions |
| Opera Neon | Full browser | Neon Do, with subscription | Page content sent to Opera and OpenAI servers |
| Brave Leo | Brave’s built-in assistant | Experimental, isolated profile | Feature still in testing |
| Claude in Chrome | Extension | Yes, paid plans | Runs in your usual Chrome |
Sources: publishers’ websites and help centres, checked on 22 October 2026.
What you can reasonably hand over
A browser agent shines on long, repetitive and reversible tasks. It becomes risky as soon as a mistake costs money or exposes your data.
| Task | Value | Caution level |
|---|---|---|
| Compare prices or timetables across several sites | High, real time saved | Low: you check the result |
| Pre-fill an administrative form | Medium | Medium: review every field before sending |
| Sort and summarise research tabs | High | Low |
| Book and pay for a trip | Medium | High: confirm the payment yourself |
| Act inside your bank or work inbox | Low | Very high: avoid |
Our article on autonomous AI agents explains why these tools still need you for the decisions that matter.
Risk number one: prompt injection
A browser agent reads pages written by anyone. Yet a language model does not clearly separate its user’s instructions from the text it is processing. A sentence hidden in a page, in white text on a white background or inside a comment, can tell it to do something else: open your inbox, copy a code, send a message. That is prompt injection.
The danger comes from three things combined: the agent reads untrusted content, it has your logged-in sessions and it can act. A tricked chatbot produces a strange answer; a tricked agent can actually do something.
No publisher promises complete protection. These defences reduce the risk; they do not remove it. The other weak spots of agents, such as misreadings, loops and dropped tasks, are covered in the limits of AI agents.
Good habits before you let AI browse
- Keep a human in the loop: payments, sending messages, changing passwords and deleting anything should be confirmed by hand.
- Keep uses apart: give the agent a dedicated browser profile, without your banking sessions or main inbox. That is the idea behind a sandbox.
- Actually follow the steps: seeing the agent’s plan only helps if you look at it.
- Be wary of open pages: forums, reviews, comments and emails from strangers are the easiest injection vectors.
- Read the privacy settings: with Opera, for instance, the content of the pages it processes goes to Opera’s and OpenAI’s servers.
Before you delegate a task, run it through our free tool:
Frequently asked questions
What is an AI browser agent?
It is an AI assistant built into a browser, or driving one, that does more than summarise a page: it opens websites, clicks, fills in forms and chains steps together to reach the goal you set. Perplexity's Comet and Opera's Neon Do are two examples.
Are AI browser agents free?
The browsers themselves often are, but the agent is usually reserved for subscribers. According to Perplexity, Comet's agent tasks are not included in the free plan, and Opera keeps its Neon Do and Make agents for its Standard subscription.
Can I let a browser agent handle my payments?
Not without supervision. The agent can click the wrong button or be hijacked by a booby-trapped page. Let it prepare the basket or the form, then confirm the payment yourself.
What is prompt injection in an AI browser?
It is an instruction hidden in a web page, a comment or an email that the agent reads and may follow as if it came from you. Because the agent acts with your logged-in sessions, this can lead to a data leak or an unwanted action.
Does ChatGPT Atlas still exist?
No. The Atlas browser, announced by OpenAI in October 2025, has been retired. OpenAI moved agentic browsing into the ChatGPT desktop app, Codex and its Chrome extension.