An agentic browser is a web browser with an artificial intelligence (AI) agent built into it, able to navigate websites and complete tasks such as booking, form-filling and shopping on the user's behalf. A user types or speaks an instruction; the browser plans the steps, opens pages, clicks, scrolls and types, then pauses for approval before anything consequential. The category exists because the browser already holds what an agent needs: the user's cookies, saved passwords, open tabs and logged-in accounts. Perplexity's Comet, Opera Neon, The Browser Company's Dia, Microsoft Edge's Copilot Mode and Google Chrome with Gemini are the best-known examples. OpenAI's ChatGPT Atlas belonged on that list until its retirement in 2026.

How an agentic browser works

Most agentic browsers are built on Chromium, the open-source code behind Chrome, so they render pages and run extensions the way Chrome does. What differs is a second layer: an assistant, usually in a side panel, that can read the page in front of it and act on it.

A task runs in a loop. A planning model, typically hosted in the vendor's cloud, receives a representation of the current page, decides the next action and sends it back to the browser, which executes it as a click, keystroke or navigation. The browser captures the new state and repeats. Agents perceive pages in three ways - screenshots, HTML and the accessibility tree, the browser's structured map of buttons, links and fields - and most combine them.

Two design choices separate this from a standalone computer use agent. First, the agent acts inside the user's real profile, not a fresh virtual machine, so it is already signed in to email, retailers and banks. Second, the browser vendor controls the whole stack. Opera said its Browser Operator, previewed on March 3, 2025, ran "deep in the core of the browser" with no screenshots and no virtual machine, according to the company.

Configuration is mostly about permission. Google's Chrome agent, according to a December 8, 2025 post by Nathan Parker of Chrome's security team, pauses before banking or medical sites, before signing in through Google Password Manager and before purchases or messages. Chrome adds a separate Gemini-based User Alignment Critic that vets each proposed action against the user's goal while seeing only metadata, never raw web content, and Agent Origin Sets that limit which sites the agent may read from or write to.

Who sits on each side

On one side are the browser and assistant makers: Google, Microsoft, Perplexity, Opera, Atlassian (owner of Dia), Anthropic and OpenAI. They monetise through subscriptions more than ads. Comet launched for $200-a-month Max subscribers; Opera Neon costs $19.90 a month after an introductory offer; Chrome's auto browse launched for Google AI Pro and AI Ultra subscribers in the US.

On the other side are websites: publishers, retailers, airlines and banks. They receive the agent's traffic, often without being able to tell it apart from a person. Amazon alleged that Comet's agent transmitted the same user-agent string as Google Chrome. Google took the opposite route, adding a Google-Agent fetcher to its documentation on March 20, 2026 with its own user-agent token and IP ranges. Because a human triggers each request, Google-Agent ignores robots.txt.

Origin and evolution

Research came first. OpenAI's World of Bits environment (2017) trained agents on simple web tasks, and its WebGPT (December 2021) answered questions using a text-only browser. Google's Project Mariner, a Chrome extension prototype announced on December 11, 2024, showed a frontier lab putting an agent into a mainstream browser.

The product category formed in 2025. Opera claimed to be the "first major browser with AI-based agentic browsing" when it previewed Browser Operator at Mobile World Congress in March. The Browser Company opened Dia in invitation-only beta on June 11, Perplexity launched Comet on July 9, and Microsoft introduced Copilot Mode in Edge on July 28, an opt-in mode that Mustafa Suleyman, chief executive of Microsoft AI, called "a big step towards an AI browser". Anthropic followed with Claude for Chrome for 1,000 testers on August 26.

Consolidation and price cuts arrived quickly. Atlassian agreed on September 4, 2025 to buy The Browser Company for $610m in cash. Google put Gemini into Chrome on September 18, Perplexity made Comet free worldwide on October 2, and OpenAI launched Atlas on macOS on October 21, with Sam Altman calling it "a rare once a decade opportunity to rethink what a browser can be about".

Google began rolling out Chrome auto browse to US AI Pro and Ultra subscribers on desktop on January 28, 2026, according to 9to5Google. PPC Land's July 14, 2026 report described auto browse as introduced that day; the two accounts differ on the launch date. Android followed in August 2026, according to Android Central, and Anthropic's extension, renamed Claude in Chrome, left beta in late August.

Why it matters for marketers

Chrome held 66.3% of global web traffic in Cloudflare's third-quarter 2025 data, so agentic features inside it reach most of the web by default. An agent fetching reviews may register a publisher page view with no matching ad impression, and an agent that buys directly skips sponsored listings. That second risk sits at the centre of retail media. Amazon reported $68.6bn of advertising revenue in 2025, and Trade Desk's Jeff Green estimated about 90% of it comes from sponsored listings, which is why PPC Land argued that Amazon's ad business hangs on its lawsuit against Comet.

The traffic is measurable, if inconsistently. HUMAN Security, which sells agent-detection products, put Comet at about 47% of measured agentic web traffic in May 2026, against 20.3% for Atlas. DataDome, a rival vendor, counted 58.2 million agentic browser requests in September 2026, and Meta's Muse took 33% of them within days of full availability. In DataDome's sample, 99.3% of Muse requests came from cloud infrastructure and the agent did not declare itself, so bot filters may block sessions that represent real customers. The two vendors' shares are not directly comparable.

Publishers have tried to price the shift. Perplexity's Comet Plus, announced on October 1, 2025 at $5 a month, shares revenue with outlets including CNN, Condé Nast and Le Monde.

Limitations and disputes

Security is the central problem. An agentic browser reads untrusted web content and acts with the user's credentials, so hidden text on a page can redirect it - prompt injection. Brave's researchers showed a hidden instruction in a Reddit post leading Comet to extract credentials, and LayerX's "CometJacking" used a single crafted URL to exfiltrate memory data. Shivan Kaul Sahib of Brave said that "traditional protections such as same-origin policy or cross-origin resource sharing are all effectively useless". OpenAI said in December 2025 that such attacks are "unlikely to ever" be fully solved.

Enterprise trust remains low. A December 2025 Gartner advisory titled "Cybersecurity Must Block AI Browsers for Now" told most organisations to block them, warning that "default AI browser settings prioritize user experience over security".

Consent is strained too. In October 2026, 65 researchers, 36 of them at Google, argued that consent prompts cannot govern agents that act continuously, proposing a policy engine that would allow, deny, modify or escalate each action.

Legal standing is unsettled. Amazon sued Perplexity on November 4, 2025 under the Computer Fraud and Abuse Act. A district judge enjoined Comet on March 9, 2026, but on August 4 the Ninth Circuit vacated the injunction, holding that the user, not the developer, does the accessing. The ruling addressed only the preliminary injunction, and site owners are now using contracts instead. United Airlines revised its Contract of Carriage on November 11, 2026 so that it bans AI agents from buying its tickets, seats and upgrades.

Costs fall unevenly. Cloudflare argued in October 2026 that websites pay for nearly all of 14 problems AI agents create.

What it is not

  • Computer use agent. The broader capability of an AI operating any interface through screenshots and inputs, often in a cloud virtual machine. An agentic browser packages a version of it inside a consumer browser and the user's own sessions.
  • AI browser. Often used interchangeably, but Gartner and others use it more widely for any browser with an AI sidebar that summarises or answers questions. Only the ability to act makes a browser agentic.
  • Cloud browser agent. Meta's Muse runs a browser in a per-user cloud virtual machine rather than on the user's device. Traffic analysts group it with agentic browsers, but it does not sit inside the person's own browser profile.
  • Agentic web. The wider idea of sites built for agents, including Chrome's WebMCP, announced on February 10, 2026, which lets sites expose structured tools instead of being clicked through.

Recent developments

The standalone browser is giving way to agents bolted onto existing ones. OpenAI announced on July 9, 2026 that it would retire Atlas and fold browsing into ChatGPT Work, and on October 15 its ChatGPT extension gained control of Chrome tabs, reading open tabs and filling forms in signed-in sessions. Google let its Gemini Spark agent use Chrome auto browse on July 30, though Spark remains blocked in the EU and UK. Standards bodies are catching up: a W3C paper finalised on October 20 proposed a nine-point declaration putting people ahead of agents and a new Agentic Web Working Group. HUMAN measured agentic browser traffic growing eightfold between August and October 2026, as Andreessen Horowitz partners argued on November 11 that retailers "will have to fight for bots' business". Prompt injection, agent identification and the right of agents to act inside logged-in accounts remain unresolved as of November 2026.

Timeline

  • 2017 - OpenAI publishes World of Bits, an early environment for training web-browsing agents
  • December 2021 - OpenAI's WebGPT answers questions using a text-based browser
  • December 11, 2024 - Google announces Project Mariner, a Chrome extension agent
  • March 3, 2025 - Opera previews Browser Operator at Mobile World Congress
  • June 11, 2025 - Dia enters invitation-only beta
  • July 9, 2025 - Perplexity launches Comet for Max subscribers
  • July 28, 2025 - Microsoft introduces Copilot Mode in Edge
  • August 26, 2025 - Anthropic opens Claude for Chrome to 1,000 testers
  • September 4, 2025 - Atlassian agrees to buy The Browser Company for $610m
  • September 18, 2025 - Google adds Gemini to Chrome and promises agentic browsing
  • October 1, 2025 - Perplexity announces Comet Plus with publishers
  • October 2, 2025 - Comet becomes free worldwide
  • October 21, 2025 - OpenAI launches ChatGPT Atlas; Atlassian completes the Browser Company deal
  • November 4, 2025 - Amazon sues Perplexity over Comet
  • December 2025 - Gartner advises organisations to block AI browsers; Google details Chrome's agent security architecture
  • January 28, 2026 - Chrome auto browse begins rolling out to US AI Pro and Ultra subscribers, according to 9to5Google
  • February 10, 2026 - Google's Chrome team announces WebMCP
  • March 9, 2026 - District court enjoins Comet from Amazon accounts
  • March 20, 2026 - Google adds the Google-Agent fetcher to its documentation
  • May 2026 - HUMAN measures Comet at about 47% of agentic traffic, Atlas at 20.3%
  • July 9, 2026 - OpenAI announces Atlas's retirement and launches ChatGPT Work
  • July 30, 2026 - Gemini Spark gains Chrome auto browse, outside the EEA, Switzerland and the UK
  • August 4, 2026 - Ninth Circuit vacates the injunction against Comet
  • August 2026 - Chrome auto browse reaches Android in the US; Claude in Chrome leaves beta
  • September 8, 2026 - Meta launches Muse, with a browser running in a per-user cloud virtual machine
  • September 2026 - DataDome counts 58.2 million agentic browser requests, 33% from Muse
  • October 15, 2026 - ChatGPT's Chrome extension gains control of tabs
  • October 20, 2026 - W3C paper proposes an Agentic Web Working Group
  • November 11, 2026 - United Airlines bars AI agents from bookings; a16z argues firms must court agents

Summary

Who. Browser and assistant makers including Google, Microsoft, Perplexity, Opera, Atlassian's The Browser Company, Anthropic and OpenAI build agentic browsers or browser agents. Users delegate tasks to them, while publishers, retailers, airlines and banks receive their traffic, and security firms such as Brave and LayerX probe their weaknesses.

What. A web browser with a built-in AI agent that plans and carries out tasks - clicking, typing, navigating and filling forms - inside the user's own signed-in sessions, usually pausing for approval before purchases or messages.

When. Research prototypes date to 2017, and Project Mariner appeared in December 2024. The category formed in 2025 with Opera's Browser Operator in March, Dia in June, Comet in July and Atlas in October. Chrome's auto browse began rolling out in January 2026, and Atlas was retired in July 2026.

Where. On desktop first, in Chromium-based browsers on Windows and macOS, with Chrome's agent reaching Android in the US in August 2026. Some Google agent features remain unavailable in the EU and UK. The effects land on every site the agent visits.

Why. The browser already holds a user's sessions, passwords and tabs, making it the natural place for an agent to act. That same access makes agentic browsers vulnerable to prompt injection and puts them at the centre of disputes over ad impressions, sponsored listings and who has the right to access a site.