Four different AIs can now take over your web browser — clicking, filling forms, and doing your busywork while you watch. This is the honest scorecard for the big four (ChatGPT Atlas, Perplexity Comet, Claude in Chrome, and Gemini in Chrome) plus the developer wildcard Codex in Chrome: which one to use for what, who actually won the same-task race, and — the part nobody shows you — the prompt-injection attacks that can turn a friendly agent against you, with a one-page safety checklist.

Get the free AI Browser-Agent Field Guide

AI browser agents are the most over-hyped 'I tried it' topic on the internet right now, so here's the honest version. Four agents can drive a browser for you and they are NOT the same kind of thing: ChatGPT Atlas is OpenAI's own Chromium browser with an agent mode (free browser; agent mode is Plus/Pro/Business; macOS-only today). Perplexity Comet is a standalone browser and the access leader — free on Mac, Windows, iOS and Android — strongest at multi-tab research. Claude in Chrome is an EXTENSION (not a browser), paid-only and still beta, but the most careful and the most developer-native (Gmail/GitHub/Docs, plus Claude Code debugging). Gemini in Chrome is Google building the agent straight into the Chrome two billion people already use — but the real autonomous agent (Auto Browse) is US-only and behind a paid plan. And Codex in Chrome is the wildcard everyone miscategorizes: it's a CODING agent that reaches into your signed-in Chrome to test and debug web apps — not a consumer AI browser. On a real same-task test (research options, build a comparison, start a booking form), Comet wins on free research and access, Atlas feels the most like a proactive assistant — but none of them finish cleanly: independent tests put these agents around a 30% failure rate on genuinely new multi-step tasks. They're fast interns, not autopilot. Then there's the part that actually matters: a browser agent is logged in as YOU, and researchers keep tricking these agents — through a web page — into doing things you never asked. It's called prompt injection. Brave showed a 'summarize this Reddit post' request make Comet open the user's email and steal a one-time login code; CometJacking turned one crafted link into a Gmail/calendar data exfiltration; Atlas 'Tainted Memories' planted instructions that fired again in later sessions; HashJack hit multiple browsers. Anthropic is the only vendor publishing its own attack-success numbers (its browser agent failed these attacks 23.6% of the time, cut to about 11% with hardening) and says plainly: no browser agent is immune to prompt injection. It's real enough that in March 2026 a US federal judge ordered Perplexity's agent to stay out of logged-in Amazon. This 6-page field guide gives you the full scorecard, a which-one-for-what picker, the documented attacks, and a one-page safety checklist — the simple rules that keep an agent from doing something dumb on your behalf (never leave one unsupervised on a money or email tab; give it boring/public/reversible work; require confirmation before it can spend, send, or delete). Use the agents — just don't hand them the keys to everything you're logged into without reading this first.

Subscribe to Hyperautomation AI ReportGet the PDF freeKeyword: RACE

By submitting, you'll be subscribed to the Hyperautomation AI Report newsletter — one practical AI email per week. Unsubscribe anytime.

Free. No spam. Unsubscribe anytime.