What AI browsers and browser agents mean for client data

AI browsers such as Perplexity Comet, and AI desktop apps with built-in browsers such as the ChatGPT desktop app, put an AI agent where end users work, and their agent modes can click, type, and submit forms on the end user's behalf, inside sessions that are already signed in. A malicious web page can hide instructions that steer the agent, a technique called indirect prompt injection, and the UK's National Cyber Security Centre has warned such attacks may never be fully mitigated. For most small business clients, the right move today is to block unapproved AI browsers and desktop AI apps on managed devices and give end users an approved AI tool instead.

What is an AI browser?

An AI browser is a web browser with an AI assistant built in rather than opened in a tab. Comet from Perplexity is the best-known standalone example. OpenAI launched ChatGPT Atlas in October 2025, retired it in August 2026, and moved its browser and agent features into the ChatGPT desktop app. The products keep changing shape, but the risks travel with the agent, not the product name.

Two features separate them from a chat tool:

• The assistant reads what's on screen. It can summarize the open page, compare tabs, and answer questions about what the end user is looking at. That means the content of those pages goes to the AI service.
• The agent can act. In agent mode, the browser navigates, clicks, fills in forms, and completes tasks across sites, using whatever accounts the end user is already signed in to.

The second feature is the one that changes the risk. A chat tool only sees what an end user pastes into it. An agent in the browser can reach the end user's email, file storage, CRM, and banking portal, because the browser is already signed in to all of them.

What are the risks for client data?

Four risks stand out, and the first one is the reason most security teams are cautious.

1. Prompt injection turns the agent against the end user. An AI agent reads web pages as text, and it can't reliably tell the end user's request apart from instructions hidden in a page. An attacker plants instructions in a web page, a shared document, an email, or even a comment on a legitimate site. When the agent reads it, the agent may follow those instructions instead, such as opening the end user's inbox, copying data, and sending it to the attacker. OpenAI called prompt injection one of the most significant risks it defended against in ChatGPT Atlas, and researchers have repeatedly shown working attacks against agentic browsers since they launched.

2. The agent acts inside signed-in sessions. Session cookies, saved passwords, and single sign-on all work for the agent the same way they work for the end user. MFA doesn't help here, since the session already exists. A misled agent has the same reach as the end user, across every app open in that browser.

3. Page content goes to the AI service. The assistant needs to see a page to summarize it. Client records in a CRM tab, a patient portal, or a payroll system can end up with the AI vendor, often under the end user's personal account and the vendor's consumer terms.

4. The browser sits outside the client's existing controls. Policies, extensions, and hardening rules that the MSP set in Chrome and Edge don't carry over to a new browser. An end user who installs an AI browser moves their work to a place where web filtering, DLP, and login controls in the managed browsers no longer apply.

That combination is why Gartner advised organizations in December 2025 to block AI browsers for now, and why the advice still fits most small businesses.

How can you tell AI browsers are already in use?

It's worth checking before setting policy. Some AI browsers can install per user, so end users without admin rights may still be able to add one. Signs to look for:

• Software inventory. New browser applications in the RMM's installed software list, often under the end user's profile rather than system-wide.
• Browser usage that drops. An end user whose activity in the managed browser falls off while their devices stay busy may have moved to another browser.
• Sign-ins from a new browser. Microsoft Entra sign-in logs record the browser for each sign-in, so an unfamiliar one can stand out.
• Help desk questions. "Can I import my bookmarks into Comet?" is a sign the decision has already been made.

Treat a discovery as a conversation, not a reprimand. End users who install an AI browser usually want help with real work, which is a reason to offer an approved tool rather than just take the new one away.

What should MSPs do about AI browsers?

Block first, offer an alternative, and revisit the decision as the products mature.

1. Add AI browsers to the client's AI policy. Name them explicitly. A policy that says "approved AI tools only" leaves room to argue that a browser isn't a tool. For a framework, see how to make a client's AI policy enforceable.
2. Block unapproved browsers on managed devices. Stop AI browsers, AI desktop apps with built-in browsers, and any other browser the MSP doesn't manage from launching. This also keeps every other browser control effective.
3. Offer an approved AI tool. A business plan for an AI assistant, used in a managed browser with company accounts, covers most of what end users wanted from the AI browser.
4. Govern the AI built into approved browsers. Edge and Chrome both include AI features. Decide which ones the client allows, and turn off the rest through browser policy, starting by hiding or turning off the Copilot sidebar in Edge where the client hasn't approved it.
5. Keep agents away from sensitive accounts. If a client approves an agentic tool for a specific job, run it with a separate, minimally privileged account, and keep it away from email, banking, and admin portals.
6. Review every quarter. AI browsers are changing quickly. Revisit the decision when vendors ship stronger isolation between web content and agent instructions, and when the client's needs change.

The firm position matters most at small clients. A 20-person company has no security team to watch what an agent does in a signed-in session, so the block is the control.

How does Atakama handle AI browsers?

The Disable browsers rule in Atakama lists AI browsers in their own section, including Comet, with a setting for all other unapproved browsers. Enforced by the Atakama Endpoint Agent, the rule detects and stops those browsers on managed devices, so AI browsers can't run beside Chrome and Edge, where the client's web filtering, upload and paste blocking, and SaaS login controls apply. The AI hardening rule does the same for desktop AI apps, including the ChatGPT desktop app.

For AI inside the approved browsers, the browser hardening rule can block the Copilot sidebar in Edge, and the AI controls guided setup walks admins and techs through the AI-specific rules in order. For MSPs, the AI browser block can be set once as a global rule instead of being rebuilt client by client.

FAQ

What is an AI browser?

A web browser with a built-in AI assistant that can read the pages an end user has open and, in agent mode, act on them by clicking, typing, and submitting forms. Perplexity Comet is the best-known standalone example, and similar agent features now ship inside AI desktop apps.

Are AI browsers safe for business use?

Not yet for most small businesses. Agents can be misled by instructions hidden in web pages, they act inside signed-in sessions, and page content goes to the AI service. Gartner advised most organizations to block AI browsers for now, and that advice still fits clients without a security team.

What is indirect prompt injection?

An attack where instructions are hidden in content an AI agent reads, such as a web page, document, or email. The agent treats the hidden text as instructions and may act on it, for example by sending the end user's data to the attacker.

Should MSPs block Comet and other AI browsers?

Yes, on managed devices, unless the client has approved a specific use with its own safeguards. Pair the block with an approved AI assistant on a business plan, so end users have a sanctioned way to get the same help.

What about AI features in Chrome and Edge?

Govern them through browser policy. Decide which AI features the client approves, and turn off the rest, such as the Copilot sidebar in Edge.

Does MFA protect against a hijacked AI agent?

No. The agent works inside sessions where the end user already completed MFA. For more on why signed-in sessions are the target, see why MFA alone doesn't stop session hijacking.

Keep reading

For related risks, see AI agents with access to email and files, how ClickFix and fake AI installers work, how to make a client's AI policy enforceable, and our page on shadow AI governance for MSPs.

Sources

• The Register, Block all AI browsers for the foreseeable future: Gartner, December 2025
• CyberScoop, OpenAI on prompt injection in ChatGPT Atlas, December 2025
• UK National Cyber Security Centre, Mistaking AI vulnerability could lead to large-scale breaches, December 2025
• Brave, Agentic browser security: indirect prompt injection in Perplexity Comet, August 2025
• TechRadar, OpenAI shuts down its Atlas browser after not even a year, July 2026