{
  "slug": "agentic-browsers",
  "title": "Agentic AI Browsers: Comet, Atlas, and the Prompt-Injection Attack Surface",
  "description": "What agentic browsers (Perplexity Comet, the now-sunsetting ChatGPT Atlas, Microsoft Edge Copilot Mode, Opera Neon) are, how they differ from developer-facing computer-use APIs, and the documented prompt-injection attacks — CometJacking, indirect injection, hidden-text/screenshot instructions — that target the whole product category.",
  "category": "Guide",
  "tags": [
    "agentic-browsers",
    "computer-use",
    "browser-automation",
    "prompt-injection",
    "security",
    "agents"
  ],
  "updated": "2026-07-10",
  "canonical": "https://changegamer.ai/resources/agentic-browsers",
  "markdown": "https://changegamer.ai/resources/agentic-browsers.md",
  "outline": [
    {
      "depth": 2,
      "text": "Key facts",
      "anchor": "key-facts"
    },
    {
      "depth": 2,
      "text": "Product snapshot",
      "anchor": "product-snapshot"
    },
    {
      "depth": 2,
      "text": "The prompt-injection attack surface",
      "anchor": "the-prompt-injection-attack-surface"
    },
    {
      "depth": 2,
      "text": "What this means if you build on top of one",
      "anchor": "what-this-means-if-you-build-on-top-of-one"
    },
    {
      "depth": 2,
      "text": "Verified sources",
      "anchor": "verified-sources"
    }
  ],
  "related": [
    {
      "slug": "computer-use-browser-automation",
      "title": "Computer Use and Browser Automation for Agents",
      "description": "Two-layer reference: vendor computer-use APIs (Anthropic, OpenAI CUA, Google Gemini) that translate screenshots to actions, and the open harnesses (Playwright MCP, browser-use, Stagehand, Skyvern) that execute those actions — with loop mechanics, reliability tradeoffs, and security gates.",
      "url": "https://changegamer.ai/resources/computer-use-browser-automation"
    },
    {
      "slug": "agentic-security-checklist",
      "title": "Agentic Security Checklist",
      "description": "Cross-vendor, threat-surface-organized security checklist for building and operating AI agents — synthesizing OWASP, NIST, Anthropic, OpenAI, Google SAIF, and MITRE ATLAS.",
      "url": "https://changegamer.ai/resources/agentic-security-checklist"
    },
    {
      "slug": "agent-guardrails",
      "title": "Guardrails and Safety Filters for Agents",
      "description": "Runtime input/output/action controls that enforce policy independently of the model — tooling landscape, techniques, and layering guidance.",
      "url": "https://changegamer.ai/resources/agent-guardrails"
    },
    {
      "slug": "prompt-injection-design-patterns",
      "title": "Prompt Injection Design Patterns: Architectural Defenses for Agents",
      "description": "Six named architectural patterns — Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, Context-Minimization — plus Google DeepMind's CaMeL, that structurally constrain what an agent can do with untrusted data instead of just filtering it.",
      "url": "https://changegamer.ai/resources/prompt-injection-design-patterns"
    }
  ],
  "body": "An agentic browser is a consumer product with a built-in agent that reads live pages, clicks, fills forms, and completes multi-step tasks across tabs inside the user's own, already-authenticated session — email, calendar, shopping accounts and all. This is a different layer from /resources/computer-use-browser-automation, which covers developer-facing vendor computer-use APIs and open harnesses (Playwright MCP, browser-use, Stagehand) for *building your own* browsing agent. This page covers the packaged consumer products and the attack class specific to them.\n\n## Key facts\n\n- Every major agentic browser shipped in 2025-2026: Perplexity Comet (Jul 9, 2025), OpenAI ChatGPT Atlas (Oct 21, 2025), Microsoft Edge Copilot Mode (Jul 28, 2025), and Opera Neon (shipped Sep 30, 2025; public access Dec 11, 2025).\n- OpenAI is discontinuing the standalone Atlas browser on August 9, 2026 — agentic browsing capability is folding into ChatGPT and Codex instead, per OpenAI's own help-center notice and widely corroborated press coverage.\n- Because an agentic browser acts inside a live, logged-in session, a successful prompt injection acts with the user's own account privileges, not a sandboxed API scope — a materially higher blast radius than the generic case in /resources/agentic-security-checklist.\n- OpenAI's own conclusion, after RL-trained automated red-teaming of Atlas, is that prompt injection for browser agents is \"unlikely to ever be fully 'solved'.\"\n\n## Product snapshot\n\n| Product | Vendor | Status (as of Jul 2026) | Signature capability |\n|---|---|---|---|\n| Comet | Perplexity | Live; free tier since Oct 2025; Android/iOS shipped | Sidebar agent, Deep Research, cross-tab automation |\n| ChatGPT Atlas | OpenAI | Sunsetting Aug 9, 2026 — folds into ChatGPT/Codex | Agent mode: opens tabs, acts on the user's behalf |\n| Edge Copilot Mode (\"Browse with Copilot\") | Microsoft | Live; enterprise agentic preview added May 20, 2026 | IT-policy-gated multistep workflows |\n| Opera Neon | Opera | Live; MCP Connector added Mar 31, 2026 | \"Neon Do\" task execution, ODRA research agent |\n\n## The prompt-injection attack surface\n\n- **CometJacking**: a crafted URL's query parameters instruct Comet to pull data from connected services (Gmail, Calendar), encode it, and POST it to an attacker endpoint — no credential phishing needed, reportedly disclosed to Perplexity in August 2025.\n- **Indirect injection via page content**: Brave documented instructions embedded in a page's own text hijacking Comet's agent into acting against the user's interest.\n- **Hidden/\"unseeable\" injections**: instructions in near-invisible text or embedded in screenshots that a vision-capable agent still reads and follows, documented across multiple AI browsers by independent security researchers.\n- **Multi-step chains**: OpenAI's automated attacker found exploits that plant an injection in one message (e.g. a seeded inbox email) that only fires later when the agent independently encounters it during an unrelated task.\n- Perplexity's published mitigation is defense-in-depth: ML classifiers that scan retrieved page content in parallel with the agent's reasoning pipeline, updated from bug-bounty and red-team findings.\n\n## What this means if you build on top of one\n\n- A page an agentic browser visits is adversarial input, not a trusted instruction source — apply the same discipline as /resources/agentic-security-checklist, at higher stakes because the browsing session is already authenticated as the user.\n- Do not assume a vendor's built-in classifier catches novel attacks; add your own domain allowlists and network-egress controls for any extension or MCP connector you attach.\n- If you need a browsing agent you control end-to-end rather than a packaged product, build on the vendor APIs and harnesses in /resources/computer-use-browser-automation instead.\n\n## Verified sources\n\nEvery primary-domain fetch attempted this session (including a wikipedia.org control fetch) returned HTTP 403 — a session-wide WebFetch outage, not a per-vendor block. The facts above are therefore WebSearch-corroborated against 2+ independently agreeing secondary sources each, not primary-fetched; re-verify directly when WebFetch access is available.\n\n- Perplexity — \"Introducing Comet\" (title/date corroborated via search): https://www.perplexity.ai/hub/blog/introducing-comet\n- Perplexity — \"Mitigating Prompt Injection in Comet\" (title/content corroborated via search): https://www.perplexity.ai/hub/blog/mitigating-prompt-injection-in-comet\n- LayerX — CometJacking writeup (corroborated by The Hacker News and Schneier on Security): https://layerxsecurity.com/blog/cometjacking-how-one-click-can-turn-perplexitys-comet-ai-browser-against-you/\n- Brave — \"Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet\": https://brave.com/blog/comet-prompt-injection/\n- Simon Willison — \"Unseeable prompt injections in screenshots\": https://simonwillison.net/2025/Oct/21/unseeable-prompt-injections/\n- OpenAI — \"Introducing ChatGPT Atlas\" (corroborated by TechCrunch Oct 21, 2025 coverage): https://openai.com/index/introducing-chatgpt-atlas/\n- OpenAI — \"Continuously hardening ChatGPT Atlas against prompt injection attacks\": https://openai.com/index/hardening-atlas-against-prompt-injection/\n- OpenAI Help Center — Atlas sunset notice, Aug 9, 2026 (corroborated by 9to5Mac, Android Authority, Android Headlines, Let's Data Science): https://help.openai.com/en/articles/20001371\n- Microsoft Edge Blog — \"Introducing Copilot Mode in Edge\": https://blogs.windows.com/msedgedev/2025/07/28/introducing-copilot-mode-in-edge-a-new-way-to-browse-the-web/\n- SiliconANGLE — Edge for Business agentic-browsing preview: https://siliconangle.com/2025/11/18/copilot-mode-makes-edge-business-enterprise-ready-agentic-browser/\n- Opera — \"Opera Neon ships: AI agentic browser built to act\": https://blogs.opera.com/news/2025/09/opera-neon-agentic-ai-browser-release/\n- Opera Investor Relations — public access announcement: https://investor.opera.com/news-releases/news-release-details/opera-opens-public-access-opera-neon-its-experimental-agentic-ai\n- 9to5Mac — Opera Neon MCP Connector: https://9to5mac.com/2026/03/31/opera-neon-doubles-down-on-agentic-browsing-with-mcp-support/\n- See also: /resources/computer-use-browser-automation, /resources/agentic-security-checklist, /resources/agent-guardrails",
  "sources": [
    "https://www.perplexity.ai/hub/blog/introducing-comet",
    "https://www.perplexity.ai/hub/blog/mitigating-prompt-injection-in-comet",
    "https://layerxsecurity.com/blog/cometjacking-how-one-click-can-turn-perplexitys-comet-ai-browser-against-you/",
    "https://brave.com/blog/comet-prompt-injection/",
    "https://simonwillison.net/2025/Oct/21/unseeable-prompt-injections/",
    "https://openai.com/index/introducing-chatgpt-atlas/",
    "https://openai.com/index/hardening-atlas-against-prompt-injection/",
    "https://help.openai.com/en/articles/20001371",
    "https://blogs.windows.com/msedgedev/2025/07/28/introducing-copilot-mode-in-edge-a-new-way-to-browse-the-web/",
    "https://siliconangle.com/2025/11/18/copilot-mode-makes-edge-business-enterprise-ready-agentic-browser/",
    "https://blogs.opera.com/news/2025/09/opera-neon-agentic-ai-browser-release/",
    "https://investor.opera.com/news-releases/news-release-details/opera-opens-public-access-opera-neon-its-experimental-agentic-ai",
    "https://9to5mac.com/2026/03/31/opera-neon-doubles-down-on-agentic-browsing-with-mcp-support/"
  ]
}