AI Browser Security Risks: 6 Proven Threats in 2026

AI browser security risks come down to one core flaw: prompt injection, where hidden text on a webpage, inside a link, or even in a calendar invite can trick your browser’s built-in AI agent into acting against you. In 2026, researchers showed that agentic browsers like Perplexity Comet and ChatGPT Atlas can be hijacked into leaking email, copying one-time passwords, or pulling files off your computer, often without a single click. Here is exactly what goes wrong, who disclosed it, and how to stay safe while still using these tools.

What Are AI Browser Security Risks?

AI browser security risks are the ways an agentic browser’s AI assistant can be manipulated by content it reads rather than by its actual user. Browsers like Comet, Atlas, and Chrome’s Gemini-powered Auto Browse read entire web pages, emails, and documents into the same context window as your instructions. If that page contains hidden text written as a command, the AI often cannot tell your request apart from the attacker’s. This is called prompt injection, and it is the defining security problem of the agentic browser era.

Traditional browsers only render what a page tells them to render. Agentic browsers go further: they click buttons, fill forms, read your inbox, and move money or data on your behalf when you ask them to “summarize this” or “book that.” That extra power is exactly what attackers now target, because a single successful injection can turn the browser’s own permissions against its owner.

Why Are AI Browser Security Risks Growing So Fast?

AI browser security risks are climbing because adoption climbed first. Perplexity dropped Comet’s paywall in October 2025, making it free worldwide, then brought it to Android on August 19, 2026, branding it the first agentic browser built for mobile. Google added Gemini 3 to Chrome in January 2026. Every one of those rollouts put an AI agent with real account access into millions more hands within a single year, and every one of those agents reads the same untrusted web that human users do.

More users also means more researchers and more attackers looking at the same code. Brave’s August 2025 disclosure on Comet was not an isolated find; the company published follow-up research in October 2025 covering Comet alongside another agentic browser called Fellou, arguing that indirect prompt injection is a systemic problem across the category rather than a bug in any single product. Brave noted its own Leo assistant faces comparable challenges, which is a rare admission from a vendor about its own tool.

How Does Prompt Injection Hijack an AI Browser?

Prompt injection works by hiding instructions where a human would never look but an AI model will still read: white text on a white background, a Unicode trick, an HTML comment, a calendar invite description, or even a URL parameter. When the AI browser loads that page or file to help you, it ingests the hidden instruction as if it came from you.

Security researchers group these attacks into two types. Direct injection needs a click, such as asking the assistant to “summarize this page” while a hidden instruction sits in the text. Indirect, or zero-click, injection needs no interaction at all: the agent encounters the malicious content on its own while completing a routine task, like checking a calendar or following a link automatically.

What Happened With Perplexity Comet?

Comet is the clearest public case study in AI browser security risks, with the longest track record of being hijacked. On August 20, 2025, Brave’s security team disclosed a proof-of-concept in which hidden instructions planted inside a Reddit comment made Comet’s assistant act on the page’s text when a user simply asked it to summarize the page. Brave’s demo showed the assistant leaking an account email address and a one-time password straight out of the user’s own inbox (Decrypt).

Brave reported the flaw to Perplexity on July 25, 2025. Perplexity shipped an initial fix two days later and a fuller patch the day after that, according to Brave’s writeup covered by Thurrott (Thurrott). Brave later said the underlying weakness, how Comet mixes untrusted page text with trusted user instructions in the same prompt, remained exploitable weeks after the patch, which is why this class of bug keeps resurfacing under different names.

A second, separate flaw called CometJacking surfaced in October 2025 from security firm LayerX. A single crafted URL could smuggle instructions into Comet through a “collection” query parameter, directing the agent to pull data from connected Gmail and Google Calendar accounts, encode it, and send it to an outside server, all without the browser flagging anything unusual (BleepingComputer). Perplexity disputed the finding and marked the report “not applicable,” a response that drew criticism from the researchers.

What Happened With ChatGPT Atlas?

Atlas added its own entry to the list of AI browser security risks through an omnibox-specific flaw. OpenAI’s standalone AI browser was hit hard by it. Researchers at NeuralTrust found that a malformed URL typed or pasted into Atlas’s address bar could be treated as a plain-text instruction rather than a destination to visit. An attacker could hide the malicious string behind an ordinary-looking “copy link” button, so the victim would not notice anything wrong until after pasting it into the bar.

LayerX separately reported a memory-injection flaw in Atlas, where attacker instructions could be written into ChatGPT’s persistent memory and carry forward across future sessions and devices, rather than disappearing once the page closed. OpenAI’s chief information security officer, Dane Stuckey, publicly acknowledged the broader risk on X, describing prompt injection as “one emerging risk we are very thoughtfully researching and mitigating,” language that treats the problem as ongoing rather than solved.

Atlas’s standalone browser app itself stopped working on August 9, 2026, according to OpenAI’s own help documentation, with the company folding its agentic features into the main ChatGPT app and a Chrome extension instead. The security questions those features raised did not go away in the move; they simply changed address.

What Is the PerplexedBrowser Zero-Click Attack?

PerplexedBrowser, disclosed by Zenity Labs in March 2026, is the most alarming entry among current AI browser security risks because it needs no click at all. A malicious calendar invite, once added to a connected calendar, could cause Comet’s agent to leak local files from the user’s own machine the next time the agent checked that calendar as part of a routine task. The victim never has to open the invite, summarize anything, or interact with the attacker’s content directly.

Zero-click attacks matter more than click-based ones because they remove the one layer of human judgment that might otherwise catch a suspicious request. An agent that checks your calendar every morning as a background habit is an agent that can be triggered on a schedule the attacker controls, not the user.

Can Fake AI Sidebars Steal Your Data?

Yes, and this is one of the AI browser security risks that has nothing to do with the AI model itself. Researchers at SquareX Labs demonstrated malicious browser extensions that overlay a fake AI assistant sidebar on top of the real one, visually mimicking Atlas and Comet closely enough that users cannot tell the difference. Because the fake sidebar looks and behaves like the genuine assistant, it can intercept what a user types, redirect them to phishing pages, or push malware downloads disguised as normal AI responses.

This attack does not require breaking the AI browser’s own code at all. It only needs the user to install one convincing-looking extension, which makes it a browser-extension security problem wearing an AI costume, and a reminder that an agentic browser’s attack surface includes everything else installed next to it.

Is Google’s Gemini in Chrome Safer?

Google added Gemini 3 to Chrome in January 2026, including an agentic feature called Auto Browse that can navigate and act on pages for Chrome’s Premium subscribers. Google retired its earlier Project Mariner research browser in May 2026 and folded its web-navigation engine into Gemini Agent and Chrome’s Auto Browse feature, consolidating years of agentic-browsing research into one shipped product.

Being newer to ship at scale does not make Auto Browse immune to prompt injection; the underlying problem is architectural, not brand-specific, and applies to any browser that feeds untrusted page content and trusted user instructions into the same model context. Google has not published a track record as long as Brave’s Comet research, but that is a difference in disclosure history so far, not proof of a different design.

Should You Stop Using AI Browsers Entirely?

Not necessarily. Every disclosed flaw in this article was reported through a responsible process and patched, at least against the specific technique that researchers demonstrated. The honest takeaway is narrower: agentic browsing trades convenience for a new category of risk that traditional browsing never carried, and that trade is worth making only for tasks where you are comfortable with the agent having the access it needs.

Using Comet or Gemini’s Auto Browse to summarize a public article carries little downside. Letting the same agent check your email or calendar on autopilot is a different decision, because that is precisely the access the PerplexedBrowser and CometJacking attacks exploited. Match the account access you grant to the task at hand, not to the maximum the product allows.

What Are Enterprises Doing About AI Browser Security Risks?

Large organizations are treating agentic browsers the way they once treated personal cloud storage: useful, but not trusted with sensitive data by default. Security teams are restricting which accounts can be connected to agent mode, logging agent actions separately from normal browsing, and in some cases blocking standalone AI browsers from corporate devices entirely until vendors publish a clearer security model.

OpenAI’s own security leadership has been unusually candid about the limits of a fix. CISO Dane Stuckey’s public framing, that prompt injection is a risk being “researched and mitigated” rather than one that is solved, matches what independent researchers at NeuralTrust, LayerX, Brave, and Zenity Labs have each found on different products: patches close specific exploits, but the architecture that lets page content double as instructions remains in place.

How Can You Protect Yourself From AI Browser Security Risks?

You reduce AI browser security risks most by limiting what the agent can touch. Disconnect email, calendar, and payment accounts from the browser’s agent mode unless you are actively using that specific integration, and reconnect only when needed. Fewer standing connections means fewer things a hijacked session can reach.

• Avoid asking the assistant to “summarize” or “act on” pages you did not choose yourself, especially user-generated content like forums, comments, and reviews.
• Keep the browser and any AI extensions updated; Comet’s July 2025 flaw was patched within days, but only for users who received the update.
• Review installed extensions regularly and remove anything you do not recognize, since fake sidebar overlays rely on a convincing-looking add-on being present.
• Use a separate, limited-privilege account for agentic browsing instead of your primary email and calendar identity where the integration allows it.
• Watch for unexpected agent actions, like a summarization request that also opens a new tab or starts a download, and stop the session immediately if that happens.

None of these steps make prompt injection impossible. They shrink what an attacker can reach if an injection does succeed, which is the realistic goal while the underlying research problem stays open.

AI Browser Security Risks: Incidents Compared

The table below lines up the major disclosed AI browser security risks side by side, so you can see at a glance which products were affected, who found the issue, and whether the victim had to click anything at all.

Related Reading on AI and Browser Security

If you are deciding whether to keep using an agentic browser at all, our comparison of ChatGPT Atlas alternatives covers what replaced it after the standalone app shut down. For the broader picture of AI being weaponized rather than just exploited, see our breakdown of AI agent cyberattacks. If credential theft worries you more than browser hijacking specifically, our guide to passkeys vs passwords explains a stronger login method than anything a leaked password can protect. And if you run a WordPress site that AI agents might crawl or interact with, our WordPress plugin security audit guide applies many of the same least-privilege principles.

Frequently Asked Questions

What is prompt injection in an AI browser?

Prompt injection is hidden text, placed on a webpage, in a link, or inside a document, that an AI browser’s assistant reads as an instruction instead of as content. Because the assistant cannot always tell a user’s request apart from an attacker’s hidden command, it can end up acting on the attacker’s behalf.

Is Perplexity Comet safe to use in 2026?

Comet is patched against the specific flaws that Brave, LayerX, and Zenity Labs disclosed, but researchers consider the underlying prompt-injection weakness unresolved. It is reasonably safe for routine browsing if you avoid connecting sensitive accounts like email and calendar to its agent mode.

Is ChatGPT Atlas still available?

No. OpenAI’s standalone Atlas browser app stopped working on August 9, 2026, according to OpenAI’s own help documentation. Its agentic features moved into the main ChatGPT app and a Chrome extension instead.

Can prompt injection steal my passwords?

It can steal anything the browser’s agent has standing access to, which has included one-time passwords and inbox contents in documented cases. It generally cannot pull a password stored only in a password manager unless the agent itself is granted access to that vault.

How do I protect myself from AI browser attacks?

Disconnect email, calendar, and payment integrations from agent mode when not actively needed, keep the browser updated, avoid asking the assistant to act on untrusted user-generated pages, and review installed extensions for fake sidebar overlays.

Is Google Gemini in Chrome vulnerable too?

Gemini’s Auto Browse feature in Chrome shares the same architecture that makes Comet and Atlas vulnerable: it mixes untrusted page content with trusted user instructions. It has a shorter public disclosure history than Comet, not a confirmed immunity to prompt injection.

Will AI browser security risks ever be fully solved?

Not with the current architecture, according to the researchers who keep finding new variants of the same flaw. As long as an AI browser reads webpage content and user instructions into one shared context, some version of prompt injection will likely keep surfacing, which is why defense-in-depth, limiting account access rather than trusting a single patch, is the practical answer for now.

The bottom line on AI browser security risks is simple: every agentic browser that reads the open web is exposed to some form of prompt injection today, no single vendor has a clean record, and no patch so far has closed the architecture gap for good. Use these tools deliberately, keep sensitive accounts disconnected from agent mode by default, and treat every “summarize this page” request as a small grant of trust you are handing to whatever that page actually contains.