Are AI Browsers Like ChatGPT Atlas and Perplexity Comet Safe for Your Business?

They are useful but carry a real, structural security risk, so the honest answer is to use them with awareness rather than blind trust. The core issue is prompt injection: a web page can hide instructions that the browser’s AI agent reads and obeys, overriding what you asked it to do, and because the agent acts with your logged-in sessions, it can leak your data or take actions you did not intend. OpenAI, which builds ChatGPT Atlas, has said prompt injection is "much like scams and social engineering on the web, unlikely to ever be fully solved," which is a notable admission from the vendor. University of Washington researchers reinforced the concern, finding that four of seven agentic browsers they tested allow attackers to bypass the same-origin policy, with a working proof of concept on ChatGPT Atlas in which one site stole data from another. None of this means AI browsers are unusable; it means the risk is inherent to how they work, not a bug awaiting a single patch. Treat the agent like a capable assistant that can be socially engineered, keep the human in the loop for sensitive actions, and do not fully delegate anything you would not want a tricked assistant to do.

Prompt injection is when instructions hidden in content the AI browser reads override the instructions you actually gave it, so the agent ends up working for an attacker instead of for you. The hidden instructions can live anywhere the agent looks: visible or invisible text, an image caption, a comment, a document, or an email. When the agent processes that content as part of doing its job, it can treat the planted instructions as commands, and because it is operating with your logged-in access, it can exfiltrate your data or perform actions you never intended, such as sending your emails or interacting with your accounts. The reason it is so hard to eliminate is the same reason the agent is useful: it must read and act on web content, and reliably separating "content to reason about" from "instructions to obey" is genuinely difficult when both arrive as text on a page. That is why OpenAI describes it as unlikely to ever be fully solved and treats it as an ongoing problem to reduce through updates and adversarial training rather than a one-time fix. For users, the practical takeaway is to keep sensitive tasks under human control rather than fully handing them to the agent.

The same-origin policy is a foundational web security rule that stops one website from reading another website’s data in your browser. It is the reason an advertisement embedded on a page cannot reach into your open webmail and read your messages, and it quietly protects you on nearly every site you visit. University of Washington researchers found that four of the seven agentic browsers they studied allow attackers to bypass this protection, and they demonstrated a working attack on ChatGPT Atlas in which one site stole information from another embedded within it. That matters because it is not a trick the user can spot and avoid; it is a structural weakness in how the agentic browser handles content across origins. In a normal browser the same-origin policy holds, so even a malicious page is contained; in an affected agentic browser, a hostile page or embedded element can reach across to data it should never see. For users, it is a reason to be cautious about what sensitive sites they keep open while an agent is active. For site owners, it is part of why agent traffic and the content you serve now carry security implications they did not before.

They affect you in two concrete ways beyond the risk to your individual visitors. First, a growing share of the traffic hitting your site is now an AI browser agent acting for a real person, and that traffic looks neither like a normal human session nor like a classic bot, so fraud and bot defenses that treat "automated" as "suspicious" start misfiring, either blocking real customers who use AI browsers or waving through automated abuse. The fix is to decision agent traffic, separating a legitimate delegated agent from a fraud bot using signals like delegated-access proof, consistent identity, and normal behavior, and to verify uncertain cases rather than blanket-blocking. Second, your own site can become an injection vector: if you accept and display user-generated content such as reviews, comments, or profiles, that content could contain hidden instructions aimed at the AI browsers of your other visitors, turning your page into the delivery mechanism for someone else’s attack. Treating user-submitted content as untrusted and being careful about what you render protects both your visitors and your reputation. You cannot fix the browsers, but you can manage how your store treats agent traffic and ensure your pages are not weaponized against the people who visit them.

You can try, but it is increasingly the wrong move, because blocking AI browsers now means blocking real customers. As more ordinary people browse and buy through AI browsers, treating that traffic as something to block turns away legitimate buyers who are simply using a newer tool, which shows up as lost sales and false declines rather than as prevented fraud. It is the same trap as blanket-blocking AI shopping agents: you stop some automated abuse and also reject a growing share of real customers. The better approach is to decision the traffic. Distinguish a legitimate delegated agent, a real person using an AI browser or assistant, from a fraud bot, using behavioral and identity signals, and route the genuinely uncertain cases to a verification step instead of an outright block. That keeps the good agent traffic while still stopping the bad, and it scales as agent usage grows. Blanket-blocking might feel safe, but in an agent-browser world it quietly converts a fraud-prevention goal into a customer-rejection problem, which is usually the more expensive of the two.

Focus on the parts that are actually yours to control, because the browser-side prompt-injection problem belongs to the browser vendors and no site-owner tool fixes it. There are three practical moves. First, decision agent traffic instead of blocking it: treat a real customer using an AI browser as legitimate, separate delegated agents from fraud bots with behavioral and identity signals, and verify uncertain cases rather than rejecting all automation. Second, treat user-generated content as untrusted before you render it, because in an agent-browser world your reviews, comments, and other submitted content are a potential injection payload aimed at your other visitors’ agents, so sanitizing and constraining what you display protects both them and your brand. Third, keep verifiable records of consequential actions, because as more of your traffic is agents acting for people, being able to prove what was done, by which party, and under what authorization is what lets you resolve disputes and demonstrate oversight. Together these make up the site-owner posture for the agent-browser era: you are not trying to fix the browsers, you are making sure agent traffic is handled deliberately, your pages are not weaponized, and you can prove what happened.