AI browser security means blocking what you can and governing what you cannot. See Gartner's advice, product status in 2026 and a checklist. Gartner told security leaders in December 2025 to block AI browsers for now, and the field has moved fast since: OpenAI retired ChatGPT Atlas in August 2026, while Chrome, Edge and Brave built similar features into browsers that staff already use. This guide covers what Gartner actually said, which products are still around, why prompt injection is only half of the problem, and what a privacy team should document. It is general information, not legal advice.
What Gartner said about AI browsers
Gartner's note is titled "Cybersecurity Must Block AI Browsers for Now". Gartner's own site lists it as an abstract dated 1 December 2025, written by Dennis Xu, Evgeny Mirolyubov and John Watts (Gartner document 7211030). The full text is for Gartner clients, and Gartner's page would not open for us, so the points below combine that listing with press coverage of the note, mainly The Register and Computerworld, both from 8 December 2025.
- Two defining features. Coverage says Gartner defines an AI browser by an AI sidebar that summarizes, searches and translates pages using the vendor's AI services, and an agentic transaction capability that lets the browser complete tasks on websites, especially inside logged-in sessions.
- The core finding. Gartner is quoted as saying that default AI browser settings prioritize user experience over security. Sidebar content can be sent to a cloud AI back end, and agents can be steered by hidden instructions on a page, which Gartner calls "indirect prompt-injection-induced rogue agent actions".
- The advice. Block AI browsers for the foreseeable future. Before approving any, assess the vendor's back-end AI services. If that risk is too high, stop users from downloading or installing the browser. If you do approve one, tell staff not to keep highly sensitive material open in tabs, keep agents away from email, and configure the browser not to retain data.
- Pilots. Computerworld paraphrases the note as allowing small pilots, for organizations with a higher risk tolerance, on low-risk tasks that are easy to verify and roll back.
- Timing. The "years, not months" idea is about how long it will take for controls to mature. Computerworld quotes Mirolyubov saying emerging usage-control tools will take years rather than months. Gartner's abstract, as it appears in search listings, also ties the restriction to enterprise-ready versions reaching general availability. We could not confirm the exact wording of either point from the full note.
- Updates. We found no later Gartner note that changes the position. Because Gartner's pages are behind a login, we cannot rule one out.
AI browsers in 2026: product status table
The table shows status on 5 November 2026. Each row rests on the sources linked in the text below it. Where we could only read press coverage of a vendor announcement, the row says so.
| Product | Status | What we could verify |
|---|---|---|
| ChatGPT Atlas (OpenAI) | Retired | Launched on macOS on 21 October 2025. OpenAI set 9 August 2026 as the day the standalone browser stops working, with no further security updates. |
| Perplexity Comet | Available | Desktop launch on 9 July 2025. iPhone app released 18 March 2026, free to download, with paid Pro and Max plans. |
| Dia (The Browser Company) | Available | Atlassian agreed to buy The Browser Company on 4 September 2025. Dia's site now offers macOS and Windows downloads. |
| Microsoft Edge Copilot Mode | Retired as a separate mode | Reported retired on 13 May 2026, with the features moved into Edge's Copilot button. Based on press reports. |
| Chrome with Gemini | Available | Auto browse announced 28 January 2026 for US Google AI Pro and Ultra subscribers on desktop. |
| Brave, Leo AI browsing | Early testing | Announced 10 December 2025. Brave's post, updated 5 May 2026, says it is in all release channels for early testing. |
| Opera Neon | Available by subscription | Public access opened on 11 December 2025. |
ChatGPT Atlas. TechCrunch covered the launch on 21 October 2025. 9to5Mac's report from 4 August 2026 relays OpenAI's explanation: Atlas was scheduled to stop working on 9 August, bookmarks would not transfer automatically, and users were pointed to the ChatGPT desktop app, which has a built-in browser, and to a Chrome extension. OpenAI's help-centre page on the change was not readable by us because of bot protection, so we rely on that report and on other coverage that described the shutdown as having happened on the planned date.
Perplexity Comet. MacRumors reported the iPhone launch on 18 March 2026. We did not verify the desktop pricing tiers, so the table does not state them.
Dia. Dia's own site offers downloads for macOS and Windows. Press reports describe a Windows release in autumn 2026, but we only confirmed the download page. The first draft of this article described Dia as taking a more supervisory approach than Comet. We could not verify that from Dia's own pages, so we left it out.
Chrome, Edge, Brave and Opera. 9to5Google covered the Chrome auto browse launch. Brave's AI browsing post says the user must start AI browsing manually and that it runs in a new, separate browser profile so the agent cannot see the main profile's data. That is different from Brave's Leo chat assistant, which the first draft grouped with Chrome as an always-on AI feature. Opera's press release is dated 11 December 2025.
The practical point is the one the first draft got right. A policy that says "block Atlas and Comet" was out of date within months, and agent features now often arrive as a switch inside a browser that is already approved. That is harder to inventory than a separate app.
The Amazon v. Perplexity case
The case shows why agent access to logged-in sites is also a legal question. Amazon sued Perplexity in November 2025 in the Northern District of California over Comet's shopping agent. On 9 March 2026, Judge Maxine Chesney granted Amazon a preliminary injunction, according to coverage of the order. It barred Perplexity from using AI agents to access Amazon's password-protected systems and ordered it to destroy Amazon data its agents had collected.
The first draft stopped there, and it is now out of date. The Ninth Circuit stayed the injunction pending appeal and, on 4 August 2026, vacated it in No. 26-1444, according to law-firm summaries from Troutman Pepper Locke and Ballard Spahr. The panel held that Amazon was unlikely to succeed on its computer fraud claims because the user, with the assistant as a tool, accesses Amazon's servers. Both summaries say contract and terms-of-use theories were left open, and that the case went back to the district court. We could not open the opinion itself, so treat the details as secondhand.
Why AI browser security is not solved
Security teams have focused on prompt injection, and the evidence supports that focus. In August 2025, Brave researchers showed that Comet could be steered by hidden text on a web page. In their demonstration, a Reddit comment asked the assistant, during a "summarize this page" request, to read a one-time password from the user's open Gmail session. In October 2025, Brave published a second post on near-invisible instructions hidden in screenshots, with a related issue in the Fellou browser. Brave sells a competing browser, which is worth keeping in mind, but it published the steps and its disclosure dates.
Vendors and regulators have said the problem is not closed:
- OpenAI's chief information security officer, Dane Stuckey, said prompt injection "remains a frontier, unsolved security problem", as quoted by Cyberhaven. Press coverage of an OpenAI post in December 2025 reports it saying prompt injection is unlikely to ever be fully solved. We could not open that post directly.
- The UK National Cyber Security Centre wrote on 8 December 2025 that prompt injection attacks may never be totally mitigated the way SQL injection can be, because a language model draws no inherent line between data and instructions.
- Brave's own agentic mode says that risks such as model confusion and subtle prompt injection cannot be fully eliminated, which is why it isolates the agent in a separate profile.
For a privacy team the lesson is simple. A technical control lowers the chance of a bad action, but it does not remove the need to know what data a browser could reach.
How common are AI browsers at work
The first draft said Cyberhaven data showed about 28% of organizations already had an employee using an AI browser. That is not what Cyberhaven reported. In a November 2025 post, Cyberhaven said 27.7% of enterprises it tracked had at least one employee who had downloaded ChatGPT Atlas, in the first week after launch. The figure is about one product, it counts downloads and not use, and it comes from a security vendor's customer base. It does support the broader point that adoption can outrun policy within days. It says nothing about AI browsers as a whole today, and Atlas is now retired.
AI browser privacy and governance: what did the browser touch?
Blocking is a security decision. Governance asks a different question: when an employee used an AI browser for work, which personal data did it process, who else received it, and how long was it kept?
The first draft said the browser maker becomes a processor of that data. Whether that is true depends on the contract. Dia's privacy policy, effective 9 April 2026, says The Browser Company is the controller of personal data processed in connection with Dia, and lists the pages you visit and your assistant queries as content data it processes. That is a consumer-style arrangement. A business plan with a data processing agreement could put the vendor in a processor role under GDPR Article 28. Which applies depends on the plan the employee signed up for, and shadow adoption usually skips that step.
Other policies we could check show why a single answer is risky:
- Atlas. OpenAI's help centre, as surfaced in search results, described browser memories as separate from ChatGPT memory, and a setting called "Include web browsing" that controls whether browsed content can be used for training. It was reported off by default. Atlas is retired, but the pattern is useful: training, memory and retention each had its own switch, and administrators of business plans had some controls.
- Comet. Perplexity's policy page was blocked to our tools. Third-party summaries disagree on whether a dedicated training opt-out exists, so read the current notice before you rely on any summary.
- Chrome with Gemini. Google's Gemini help page describes human review of some conversations when Gemini Apps Activity is on. We could not confirm which of those terms apply to Gemini in Chrome, or to Workspace accounts, so check Google's current documents for your plan.
A shadow-AI audit usually surfaces the same gaps: no vendor assessment, no check of retention or training terms, and no record of what data went in. Our guides on how companies audit AI usage and on third-party AI vendor due diligence cover the method.
What regulators have said so far
We found no statement from the EDPB, the UK ICO, the CNIL or the NCSC about AI browsers as a product category. Three related items are worth knowing:
- The NCSC blog on prompt injection, above, is the most direct security statement from a regulator-style body.
- The CNIL and France's AI and Digital Council published an exploratory, non-binding note on agentic AI and personal data on 20 July 2026. Law-firm coverage says it discusses persistent agent memory and traceability, and it does not address browsers as such. See Covington's summary.
- The ICO opened a call for evidence on agentic AI on 8 October 2026, and law-firm sources report that it closes on 20 November 2026. We did not open the ICO's page.
Whether using an AI browser triggers a data protection impact assessment under GDPR Article 35 depends on the data and the processing. We found no regulator ruling that says it always does.
What to do about AI browsers now
- Write down your stance for each product. Choose block, pilot or allow, and name the product. Include the AI features inside Chrome, Edge and other browsers you already allow.
- Inventory real use. Look at installed apps, extensions, DNS and endpoint logs, not just a survey. Cyberhaven's Atlas numbers show how fast adoption moved.
- Block through technical controls where you decide to block. A policy with no control behind it only pushes use out of sight. Gartner's guidance is to use existing network and endpoint controls to stop installs, and to monitor the fleet afterwards.
- Keep any pilot small and low risk. Pick a small group and tasks that are easy to check and undo. Keep agents out of email, HR, finance and customer-record sessions, and require a person to confirm actions.
- Run vendor diligence on the plan the user would use. Check controller or processor role, training use, retention, subprocessors and deletion. Prefer a business plan with a data processing agreement over a personal account.
- Record the decision. Note the lawful basis, whether a DPIA was done, and who approved the exception. Our AI governance guide and guide to agentic AI governance show how to keep that record.
- Review on a fixed cycle. This article's status table changed in under a year. Quarterly is a reasonable minimum.
For the controls side of prompt injection, see what AI governance controls are, and for how security and governance fit together, see AI governance and cybersecurity compliance. For the data side of using a hosted model, see privacy risks in LLMs.
AI browser governance checklist
▢ Confirm current AI browser use through an inventory of installs, extensions and logs, not only a policy survey
▢ Record a block, pilot or allow decision for each product, including AI features inside approved browsers
▢ Put a technical control behind every block decision
▢ Classify each AI browser in use as a vendor and review its privacy policy and terms
▢ Check controller or processor role, training use, retention, subprocessors and deletion terms for the plan in use
▢ Document the lawful basis and the DPIA decision for any personal data that passes through an AI browser
▢ Define the scope of any pilot in writing, including the sites and accounts agents may not touch
▢ Remove retired products, such as ChatGPT Atlas, from approved lists and confirm they no longer run unpatched
▢ Review the approved and blocked product list at least quarterly
How Secure Privacy fits
Blocking an AI browser is your security team's job. Proving that the decision was made properly is the privacy team's job, and that is the work Secure Privacy takes off your hands. Every item on the checklist above has a home in the platform:
- Register the browser as an AI system. AI Governance holds every AI tool in use with a risk level, a use case and a named owner. It maps each one to the regulations that apply, including the EU AI Act, and flags high-risk deployments.
- Run vendor diligence on the maker. Vendor Management keeps one register of vendors and processors, tracks contracts and data processing agreements, and scores risk per vendor through automated due diligence assessments. Alerts tell you when a contract renews or a compliance gap opens. This is where you record whether the maker acts as a controller or a processor on the plan your staff actually signed up for.
- Assess the risk. Assessments runs DPIAs and AI impact assessments from pre-built templates, suggests risks and mitigations, and routes each one through an approval workflow.
- Document the data and the lawful basis. The Data Map and Process Register records each processing activity with its purposes, legal bases, data categories and retention periods, so "what did the browser touch?" has an answer on file.
- Keep the decision current. Task owners, due dates and the compliance calendar drive the quarterly review of your approved and blocked list, and every step leaves an audit-ready history.
Secure Privacy does not intercept prompts or block installs. Your endpoint and network controls do that. What you get from us is the evidence behind the block or pilot decision: who approved it, on which assessment, under which contract, and when it comes up for review. Book a demo to see it applied to the AI tools already in use at your company.
FAQ
What is an AI browser?
An AI browser is a web browser with an AI assistant built in. Gartner describes two defining features: an AI sidebar that reads and summarizes what is on screen, and an agentic capability that can act on websites for the user, often inside logged-in sessions. Some products, such as Comet and Dia, are built around the assistant. Others, such as Chrome and Edge, add it to an existing browser.
Are AI browsers safe to use at work?
Not without controls. Gartner advised blocking AI browsers for now, prompt injection is not fully solved (the UK NCSC has said it may never be totally mitigated), and the privacy terms differ by product and by plan. A limited pilot with a written scope, vendor checks and limits on what the agent can reach is safer than open use. Treat any AI browser as an unapproved tool until someone has checked what it does with session data.
Did Gartner really tell companies to block all AI browsers?
Yes, for now. Its December 2025 note, as reported by The Register and Computerworld, recommends blocking AI browsers for the foreseeable future, assessing back-end AI services before any approval, and limiting pilots to small low-risk groups. We found no later Gartner update, though the full note and Gartner's page were not readable by us.
Is ChatGPT Atlas still a risk for my company?
The standalone browser was scheduled to stop working on 9 August 2026 and no longer receives security updates, so any copy still installed is an unpatched risk. Remove it from approved lists. The same kind of agent features now exist in the ChatGPT desktop app, a Chrome extension and other products, so the underlying questions remain.
Is blocking AI browsers enough for AI browser security?
No. A block stops installs of products you have named, but it does not cover AI features switched on inside a browser staff already use, and it does not tell you what data went through before the block. Pair the block with an inventory, vendor checks and a written decision. Prompt injection is also not fully solved, so limiting what an agent can reach matters even in an approved pilot.
Is the AI browser maker a processor of our data?
It depends on the terms. Dia's privacy policy, for example, says The Browser Company is the controller of personal data processed through Dia. A business plan with a data processing agreement might make a vendor a processor instead. Check the contract for the plan your staff actually use, and do not assume the role.
Does using an AI browser require a DPIA?
Not automatically. A DPIA under GDPR Article 35 is needed when processing is likely to result in a high risk to people. Whether an AI browser does depends on what personal data the sessions involve and how the vendor handles it. Vendor diligence usually comes first and shows whether a fuller assessment is needed.
How is this different from AI agents bypassing cookie consent banners?
That issue is about AI agents visiting your website for a user, and whether your banner and tracking respond correctly. This guide is about your own employees using an AI browser, which raises vendor and data-handling questions on the other side of the relationship. Our article on AI agents bypassing your cookie consent banner covers the website side.
