← All resources

Agentic AI Browsers: Comet, Atlas, and the Prompt-Injection Attack Surface

Guide · updated 2026-07-10 · Markdown variant

What agentic browsers (Perplexity Comet, the now-sunsetting ChatGPT Atlas, Microsoft Edge Copilot Mode, Opera Neon) are, how they differ from developer-facing computer-use APIs, and the documented prompt-injection attacks — CometJacking, indirect injection, hidden-text/screenshot instructions — that target the whole product category.

An agentic browser is a consumer product with a built-in agent that reads live pages, clicks, fills forms, and completes multi-step tasks across tabs inside the user's own, already-authenticated session — email, calendar, shopping accounts and all. This is a different layer from /resources/computer-use-browser-automation, which covers developer-facing vendor computer-use APIs and open harnesses (Playwright MCP, browser-use, Stagehand) for building your own browsing agent. This page covers the packaged consumer products and the attack class specific to them.

Key facts

• Every major agentic browser shipped in 2025-2026: Perplexity Comet (Jul 9, 2025), OpenAI ChatGPT Atlas (Oct 21, 2025), Microsoft Edge Copilot Mode (Jul 28, 2025), and Opera Neon (shipped Sep 30, 2025; public access Dec 11, 2025).
• OpenAI is discontinuing the standalone Atlas browser on August 9, 2026 — agentic browsing capability is folding into ChatGPT and Codex instead, per OpenAI's own help-center notice and widely corroborated press coverage.
• Because an agentic browser acts inside a live, logged-in session, a successful prompt injection acts with the user's own account privileges, not a sandboxed API scope — a materially higher blast radius than the generic case in /resources/agentic-security-checklist.
• OpenAI's own conclusion, after RL-trained automated red-teaming of Atlas, is that prompt injection for browser agents is "unlikely to ever be fully 'solved'."

Product snapshot

The prompt-injection attack surface

• CometJacking: a crafted URL's query parameters instruct Comet to pull data from connected services (Gmail, Calendar), encode it, and POST it to an attacker endpoint — no credential phishing needed, reportedly disclosed to Perplexity in August 2025.
• Indirect injection via page content: Brave documented instructions embedded in a page's own text hijacking Comet's agent into acting against the user's interest.
• Hidden/"unseeable" injections: instructions in near-invisible text or embedded in screenshots that a vision-capable agent still reads and follows, documented across multiple AI browsers by independent security researchers.
• Multi-step chains: OpenAI's automated attacker found exploits that plant an injection in one message (e.g. a seeded inbox email) that only fires later when the agent independently encounters it during an unrelated task.
• Perplexity's published mitigation is defense-in-depth: ML classifiers that scan retrieved page content in parallel with the agent's reasoning pipeline, updated from bug-bounty and red-team findings.

What this means if you build on top of one

• A page an agentic browser visits is adversarial input, not a trusted instruction source — apply the same discipline as /resources/agentic-security-checklist, at higher stakes because the browsing session is already authenticated as the user.
• Do not assume a vendor's built-in classifier catches novel attacks; add your own domain allowlists and network-egress controls for any extension or MCP connector you attach.
• If you need a browsing agent you control end-to-end rather than a packaged product, build on the vendor APIs and harnesses in /resources/computer-use-browser-automation instead.

Verified sources

Every primary-domain fetch attempted this session (including a wikipedia.org control fetch) returned HTTP 403 — a session-wide WebFetch outage, not a per-vendor block. The facts above are therefore WebSearch-corroborated against 2+ independently agreeing secondary sources each, not primary-fetched; re-verify directly when WebFetch access is available.

• Perplexity — "Introducing Comet" (title/date corroborated via search): https://www.perplexity.ai/hub/blog/introducing-comet
• Perplexity — "Mitigating Prompt Injection in Comet" (title/content corroborated via search): https://www.perplexity.ai/hub/blog/mitigating-prompt-injection-in-comet
• LayerX — CometJacking writeup (corroborated by The Hacker News and Schneier on Security): https://layerxsecurity.com/blog/cometjacking-how-one-click-can-turn-perplexitys-comet-ai-browser-against-you/
• Brave — "Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet": https://brave.com/blog/comet-prompt-injection/
• Simon Willison — "Unseeable prompt injections in screenshots": https://simonwillison.net/2025/Oct/21/unseeable-prompt-injections/
• OpenAI — "Introducing ChatGPT Atlas" (corroborated by TechCrunch Oct 21, 2025 coverage): https://openai.com/index/introducing-chatgpt-atlas/
• OpenAI — "Continuously hardening ChatGPT Atlas against prompt injection attacks": https://openai.com/index/hardening-atlas-against-prompt-injection/
• OpenAI Help Center — Atlas sunset notice, Aug 9, 2026 (corroborated by 9to5Mac, Android Authority, Android Headlines, Let's Data Science): https://help.openai.com/en/articles/20001371
• Microsoft Edge Blog — "Introducing Copilot Mode in Edge": https://blogs.windows.com/msedgedev/2025/07/28/introducing-copilot-mode-in-edge-a-new-way-to-browse-the-web/
• SiliconANGLE — Edge for Business agentic-browsing preview: https://siliconangle.com/2025/11/18/copilot-mode-makes-edge-business-enterprise-ready-agentic-browser/
• Opera — "Opera Neon ships: AI agentic browser built to act": https://blogs.opera.com/news/2025/09/opera-neon-agentic-ai-browser-release/
• Opera Investor Relations — public access announcement: https://investor.opera.com/news-releases/news-release-details/opera-opens-public-access-opera-neon-its-experimental-agentic-ai
• 9to5Mac — Opera Neon MCP Connector: https://9to5mac.com/2026/03/31/opera-neon-doubles-down-on-agentic-browsing-with-mcp-support/
• See also: /resources/computer-use-browser-automation, /resources/agentic-security-checklist, /resources/agent-guardrails

#agentic-browsers #computer-use #browser-automation #prompt-injection #security #agents

Category: Guide