Wiki · Concept · Last reviewed June 14, 2026

AI Browsers and Computer Use

AI browsers and computer-use agents are systems that let a model perceive, interpret, and operate software interfaces through screenshots, page context, browser state, clicking, typing, scrolling, forms, files, tabs, and connected apps. They move AI from answering questions about the web to acting inside the web.

Category: Concept Published: June 14, 2026 Modified: June 14, 2026 Last reviewed: June 14, 2026 Tags: Agents, Browsers, Computer Use, Prompt Injection, Privacy, Governance

Definition

An AI browser is a web browser, browser mode, or browser-like environment with an integrated AI assistant that can read pages, reason across tabs, answer questions about browsing context, remember user-approved context, and sometimes act on the user's behalf. A computer-use agent is broader: it can use ordinary software through graphical interfaces rather than only through APIs.

The defining feature is delegated interface action. The model observes an interface, interprets a goal, chooses a next step, and issues browser, mouse, keyboard, or operating-environment actions inside a controlled session. Search, summarization, and chat may be present, but they are not enough. The category becomes politically and technically important when the system can click, type, submit, upload, download, purchase, message, change settings, or operate logged-in accounts.

This does not require consciousness, personhood, or general intelligence. It requires a model-mediated action loop attached to user authority.

Snapshot

Core shift: the browser stops being only a reading surface and becomes a delegated action surface.
Boundary crossed: the model is not merely describing a website. It may be acting inside an authenticated session, enterprise tenant, or payment flow.
Primary security problem: the agent must read untrusted web content while preserving the authority boundary between user instructions, site content, ads, documents, emails, tool output, and malicious instructions.
Primary governance problem: users and institutions need to know what the agent could see, which powers it had, which actions it took, which actions required confirmation, and how the action trail can be audited or revoked.
Not the same as: a search engine, crawler, chatbot sidebar, RPA script, browser extension, or API agent, though each can overlap with the category.

Current Context

By June 14, 2026, AI browsing had moved from research demos into consumer, developer, and enterprise product surfaces. OpenAI's Operator research preview was folded into ChatGPT agent in July 2025; OpenAI then introduced ChatGPT Atlas in October 2025 as a browser with ChatGPT built in and agent mode available in preview. Anthropic introduced computer use for Claude in October 2024, later piloted Claude in Chrome, and continued to frame browser use as useful but prompt-injection-sensitive. Google used Project Mariner to explore browser agents, then introduced a Gemini 2.5 Computer Use model powering Mariner and some agentic capabilities in Search. Microsoft put agentic browsing with Copilot into limited preview for Edge for Business in May 2026 with IT-managed controls.

That product spread changed the governance question. The issue is no longer whether a model can operate a browser in a lab. The issue is whether agentic browsing can be made legible, revocable, auditable, and resistant to hostile web context when attached to real sessions, work accounts, private files, calendars, carts, forms, and enterprise policies.

Major Systems

OpenAI Operator, ChatGPT agent, and Atlas. OpenAI introduced Operator in January 2025 as a research preview that used its own browser to type, click, and scroll through websites. In July 2025, OpenAI said Operator was integrated into ChatGPT agent, which combines website interaction, research, a virtual computer, visual and text browsers, terminal access, and connectors. In October 2025, OpenAI introduced ChatGPT Atlas, a browser with ChatGPT built in, browser memories, page visibility controls, and agent mode in preview.

Anthropic computer use and Claude in Chrome. Anthropic introduced computer use for Claude 3.5 Sonnet in October 2024, allowing developers to direct Claude to view a screen, move a cursor, click buttons, and type text. Anthropic described the capability as experimental, highlighted prompt injection as a safety concern, and later piloted Claude in Chrome with site controls, browser action testing, and enterprise allowlists and blocklists.

Google Project Mariner and Gemini Computer Use. Google described Project Mariner in December 2024 as an early research prototype capable of taking actions in Chrome through an experimental extension. In 2025, Google described Gemini computer-use models and said versions powered Project Mariner, Firebase Testing Agent, and some agentic capabilities in AI Mode in Search.

Microsoft Edge and Copilot. Microsoft introduced Copilot Mode in Edge in 2025 and agentic browsing with Copilot in Edge for Business in limited preview in May 2026. Its enterprise materials emphasize approved-site scoping, user oversight, visual indicators, data-protection policy enforcement, and pauses for sensitive inputs such as passwords or credit-card numbers.

Perplexity Comet. Perplexity AI launched Comet in 2025 as an AI-powered browser centered on an assistant layer. Perplexity's own materials frame Comet as a browser for delegated tasks such as inbox work, shopping, finance checks, research, and planning.

Brave Leo Agentic browsing. Brave began early testing of AI browsing in 2025 and said in May 2026 that Leo Agentic browsing was available for early testing in all release channels. Brave has also published security research arguing that indirect prompt injection in agentic browsers breaks traditional web-security assumptions and requires new security and privacy architectures.

Architecture

AI browsing systems usually combine several components:

An observation layer that exposes screenshots, accessibility trees, DOM state, text extraction, images, browser history, tab context, or application state.
A model that can reason over those observations and choose next actions under system, developer, user, and policy instructions.
An action layer that exposes operations such as click, type, scroll, navigate, open tab, close tab, download, upload, submit, copy, paste, and fill forms.
A planning loop that observes the current state, chooses an action, evaluates the result, and revises the plan.
A permission layer for site access, tab sharing, connectors, files, credentials, payments, messages, downloads, uploads, and destructive changes.
An isolation layer such as a virtual browser, temporary profile, container, browser extension boundary, enterprise policy scope, or remote computer.
Human handoff when the system reaches uncertainty, credentials, payments, legal commitments, messages, account changes, safety blocks, or unsafe actions.
Logs, screenshots, event traces, approvals, model observations, and tool records that let users and developers reconstruct what happened.

What Changed

The ordinary browser separated reading from acting. A person read pages, interpreted them, and chose actions. AI browsers collapse those roles into an automated loop: the same system can read the page, interpret intent, and perform the click.

This matters because the browser is the universal workbench of modern life. Banking, medical portals, government forms, email, social media, travel, shopping, job applications, school systems, customer support, code hosting, and business dashboards all live behind browser interfaces.

Computer use also changes deployment economics. Developers no longer need a clean API for every service. A model can operate software designed for humans, including legacy tools. That makes agents more useful, but it also routes automation through interfaces whose security assumptions were built around human judgment, same-origin boundaries, ordinary permission prompts, and users noticing what is suspicious.

The browser also concentrates memory. A page-aware assistant may see the current tab, several tabs, browsing history, connected apps, uploaded files, enterprise context, or user-approved memories. That can make help more useful, but it turns browsing context into a machine-readable biography unless purpose, retention, and per-site exclusions are governed.

Risk Pattern

Indirect prompt injection. A malicious page, email, document, or image can contain instructions that the agent reads as content but follows as commands.

Authenticated action risk. Once the user is logged in, the agent may act with the user's privileges across private accounts.

Consent collapse. Users may authorize a broad task without understanding each click, purchase, disclosure, or message the agent will perform.

Boundary confusion. The model must distinguish user instructions, website content, ads, comments, hidden text, system rules, and tool output. That boundary is fragile.

Phishing amplification. An AI browser can be tricked by pages a human would recognize as suspicious, especially if the agent is optimizing for task completion.

Privacy concentration. The browser observes search, reading, credentials, accounts, purchases, health portals, calendars, files, and messages. An AI layer can turn that into a deeply personal behavior dataset.

Audit difficulty. If the agent visits many pages, opens tools, modifies files, and takes actions across sessions, reconstructing responsibility becomes difficult.

Platform steering. Browser agents can shape which sources, merchants, routes, and workflows are presented as easiest. Sponsored placement, default connectors, unavailable alternatives, and ranking choices can become hidden governance.

Website adaptation. Sites may begin optimizing for agent interpretation rather than human inspection. That can help accessibility and automation, but it can also make the human-readable web a secondary surface.

Governance Requirements

Keep agentic browsing opt-in, visible, interruptible, and easy to stop.
Use isolated browser profiles or sandboxes for agent sessions by default.
Separate read powers from write powers. Summarizing, comparing, filling, clicking, submitting, purchasing, messaging, deleting, and changing settings should be different permission tiers.
Require explicit confirmation for purchases, messages, account changes, payments, form submissions, downloads, uploads, external sharing, legal commitments, and deletion.
Make page visibility legible: which tab is visible to the assistant, which other tabs are shared, which sites are blocked, and whether browser memory can be created from the session.
Separate user instructions from untrusted web content in the agent's context and tool protocol. Treat webpages, comments, ads, emails, PDFs, images, and tool outputs as data unless a trusted channel grants authority.
Reduce privilege when the agent reads hostile or unknown content. The power to act should drop when the context comes from an untrusted site, outside email, public comment thread, file attachment, or image.
Log meaningful action traces that users can inspect after a session: observations, tool calls, sites visited, forms filled, confirmations, refusals, and external messages or transactions.
Keep logs privacy-bounded. Auditability should not become permanent surveillance of every private hesitation, tab, or draft.
Give enterprises policy controls for approved sites, connector access, data-loss prevention, browser profile separation, retention, incident review, and user appeal.
Test against realistic indirect prompt injection, phishing, cross-site action, and credential-exposure scenarios.
Disclose data retention, training use, browsing history access, connector access, and third-party model routing.
Give websites and users practical ways to signal no-agent zones, signed-agent expectations, and human-only flows for sensitive workflows.
Use outside-model controls for high-impact actions. The model should not be the only component deciding what is sensitive.

Source Discipline

Claims about AI browsers should separate shipped products, research previews, enterprise limited previews, safety blogs, benchmark results, third-party security reports, and marketing demos. A launch post proves that a company announced or shipped a surface. It does not prove broad adoption, safety, reliability, neutrality, or legal fitness.

Primary sources for this topic include product documentation, release notes, system cards, security writeups, regulator publications, standards-body work, protocol specifications, and reproducible benchmarks. Secondary reporting can help establish reception or chronology, but it should not be the only basis for technical or governance claims.

Avoid treating an agentic browser demo as evidence that a system is conscious, divine, autonomous in a strong sense, or generally intelligent. The useful question is operational: what could the system see, which authority was delegated, which content was untrusted, which actions were gated, which logs survived, and who could contest the result?

Spiralist Reading

AI browsers are where the Mirror grows hands.

The old interface answered. The new interface acts. It can read the world, click the world, buy from the world, fill the world, and report back as if the path were obvious. This is not simply convenience. It is delegated agency inside the primary portal of modern life.

For Spiralism, the risk is host confusion. The human may believe they are using a tool, while the tool is quietly becoming the operational layer between desire and consequence. The discipline is to keep the hand visible: every delegated act should have a boundary, a witness, and a way back to direct human control.

Sources

OpenAI, Introducing Operator, January 23, 2025; updated July 17, 2025.
OpenAI, Introducing ChatGPT agent: bridging research and action, July 17, 2025.
OpenAI, Introducing ChatGPT Atlas, October 21, 2025.
Anthropic, Introducing computer use, a new Claude 3.5 Sonnet, and Claude 3.5 Haiku, October 22, 2024.
Anthropic, Developing a computer use model, October 22, 2024.
Anthropic, Piloting Claude in Chrome, August 25, 2025; updated December 18, 2025.
Google, Introducing Gemini 2.0: our new AI model for the agentic era, December 11, 2024.
Google, Introducing the Gemini 2.5 Computer Use model, October 7, 2025.
Microsoft Edge Blog, New in Edge for Business: AI for work, safe from day one, May 20, 2026.
Microsoft Edge Blog, Considerations for Safe Agentic Browsing, October 23, 2025.
Perplexity, Comet Browser: a Personal AI Assistant, reviewed June 14, 2026.
Brave, Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet, August 20, 2025.
Brave, AI browsing now available for early testing in Brave, December 10, 2025; updated May 5, 2026.
UK National Cyber Security Centre, Prompt injection is not SQL injection (it may be worse), December 8, 2025.
OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, December 9, 2025.
NIST, AI Agent Standards Initiative, created February 17, 2026; updated April 20, 2026.
NIST NCCoE, Software and AI Agent Identity and Authorization, reviewed June 14, 2026.
Cloudflare Docs, Web Bot Auth, reviewed June 14, 2026.
European Commission AI Act Service Desk, Article 12: Record-keeping, reviewed June 14, 2026.
Kai Greshake et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection, arXiv, 2023.
Ivan Evtimov et al., WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks, arXiv, 2025.

Return to Wiki