CyphrQ
Menu

AI Browsers Explained: What They Do and the Settings to Check

AI browsers explained: sidebar assistants vs agent modes that click and fill forms, what they can see, and the privacy settings worth checking.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

An AI browser is a web browser with an AI assistant built in. Most work at two levels: a sidebar that reads the page you're on and answers questions about it, and an agent mode that clicks, types and fills in forms for you. The second level changes what the browser does in your name, so the settings matter more than the brand.

This is an explainer, not a review. Every product detail below comes from the vendor's own pages as they read on 24 October 2026. Features roll out by country and subscription, so check what your own copy offers.

What does an AI browser actually do?

Think of it as two separate jobs.

The sidebar assistant sits next to the page. You ask it to summarise an article, compare two open tabs or explain a clause in a contract. It reads, and you stay the one who acts. Nothing happens on a website unless you do it.

Agent mode goes a step further. You hand it a task and it operates the browser itself: opening pages, scrolling, typing into fields and pressing buttons. Google's help page for Chrome lists comparing products, adding items to a cart, booking travel and making reservations as typical tasks (Google Chrome Help). Microsoft says its agent selects, scrolls and types in Edge the way a person would (Microsoft Support).

The short version: a sidebar hands you an answer, while agent mode takes steps on real websites, often while you're signed in.

An agent mode is one kind of AI agent, and the wider guardrails for AI agents at work apply to it as well.

Which AI browsers are available now, and on which platforms?

Two status changes first. On 13 May 2026, Microsoft announced it is retiring Copilot Mode in Edge and folding its features into Edge itself. Its agent feature now goes by the name Browse with Copilot (Microsoft Edge Blog).

OpenAI has also retired its ChatGPT Atlas browser, and it no longer receives updates. If you still have it installed, see OpenAI's retirement page for your saved data, because bookmarks and tabs don't move across automatically (OpenAI Help Center).

The table only holds what each vendor's own page states. Where a page is silent, the table says so.

Product Maker What the official page describes Platforms and access Data and memory
Browse with Copilot in Edge Microsoft Agent that clicks, types and navigates inside Edge Edge desktop; Microsoft 365 Premium subscribers in the US No access to autofill, saved passwords or wallet; screenshots of its work kept up to 30 days and never used for training
Gemini in Chrome auto browse Google Agent for multi-step tasks that asks before sending messages, submitting forms and similar steps Desktop; Google AI Pro or Ultra on a personal account; US, age 18+, device set to English Chats reviewable in Gemini Apps Activity; sites it visits are marked in your Chrome history
Comet Perplexity AI browser whose Comet Assistant takes on delegated tasks Mac, Windows, iOS, Android Sends page context only when a request needs it, kept up to 30 days; history, cookies and passwords stay on the device by default
Opera Neon Opera "A browser built to act"; agent features need a subscription, listed on its page as $19.90 a month on 24 October 2026 Not stated on the product page Log-in credentials, passwords and card details stay on the device; account data, chats and history not used for training, personalisation or ads
Dia The Browser Company of New York, now part of Atlassian Browser for work; Ask Dia answers using your tabs and connected work apps macOS, Windows You choose whether it remembers your preferences; Sync is end-to-end encrypted

Dia's homepage describes an assistant, not an agent that clicks or fills in forms, so treat it as the sidebar kind unless its own documentation says otherwise (Dia). Its maker, The Browser Company of New York, is now owned by Atlassian (Atlassian shareholder letter, Q1 FY26).

What changes for your privacy when your browser has AI?

An ordinary browser keeps a record of where you went. An AI browser can also read what's on your screen and send it to a model to answer you. That includes whatever happens to be open in that tab: an inbox, an HR system, a customer record.

Three questions are worth asking of any of them.

What leaves your device, and when? Perplexity says Comet sends data only when a request requires it, such as summarising the current tab, and stores that context for up to 30 days (Perplexity Help Center). Microsoft saves screenshots of Browse with Copilot's work alongside the conversation for up to 30 days, and deleting the conversation deletes them (Microsoft Support).

What does it remember? Memory features let the assistant draw on past chats or your browsing history. Microsoft says Copilot in Edge uses browsing history only with your permission and offers long-term memory of past chats (Microsoft Edge Blog). Opera says Neon needs context such as your location, your preferred services and the page you're viewing (Opera Neon).

Which of your accounts can it act in? This is the big one for agent mode. Google says auto browse "has access to the same sites that you do, including sites you're signed into" (Google Chrome Help). Microsoft notes that Copilot can use your cookies, so existing sign-ins may carry over (Microsoft Support).

Google and Microsoft also both warn that hidden instructions on web pages can mislead their agents, a risk known as prompt injection.

In practice: in August 2025, Brave's security team published research showing that text hidden in a social media comment could steer Perplexity's Comet assistant toward the user's email address and Perplexity account, simply because the user had asked it to summarise the page (Brave). The user did nothing wrong. Being signed in was enough.

Which AI browser settings should you check before using agent mode?

  1. Memory and history. Find the setting that lets the assistant use your browsing history or remember past chats. Leave it on only if you want personalised answers, and know where to delete what it holds. In Chrome, Gemini chats live in Gemini Apps Activity (Google Chrome Help).
  2. A separate profile for the agent. Microsoft suggests clearing cookies or using a new browser profile if you don't want your sign-ins to carry over (Microsoft Support). A profile with no work accounts in it is a simple way to run an agent logged out.
  3. Site permissions. Comet lets you switch off the assistant or block it on chosen websites, and asks before agent tasks with "Allow this time only", "Always allow" or "Don't allow" (Perplexity Help Center). Edge and Chrome have their own controls, shown in the table below.
  4. Signed-in accounts. This one is general advice rather than a vendor instruction. Before you start a task, look at which accounts that profile is logged into: work email, cloud storage, an admin portal. If the task doesn't need one, sign out of it first.
  5. The stop control. Chrome offers Stop, Take over task, or simply closing the task tab (Google Chrome Help). Edge lets you interrupt or take control at any time (Microsoft Support).

Where each control lives, according to the vendor pages linked above:

Setting Chrome auto browse Browse with Copilot in Edge Comet
Memory and history Gemini chats in Gemini Apps Activity Uses browsing history only with your permission History stays on the device by default
Limit sites Review and remove the sites auto browse may sign into A list of sites Copilot should never visit Settings, Privacy and security, Comet Assistant: block it on chosen sites
Stop a task Stop, Take over task, or close the task tab Interrupt or take control at any time Not stated on the pages we used

If your company manages your browser, IT may already set some of these for you. Ask before you change them.

When should you not use agent mode?

The vendors draw part of the line themselves. Microsoft recommends watching Browse with Copilot closely and keeping it away from banking, trading and personal identifiers (Microsoft Support). Google says auto browse may hand control back to you for financial transactions, accepting terms of service or creating accounts, and that you are responsible for its actions, including purchases you didn't expect (Google Chrome Help).

Beyond the vendors' own warnings, these are general rules of thumb. Do these jobs yourself rather than through an agent.

  • Banking and payments. Transfers, payee changes and card details.
  • Work admin consoles. Email and identity admin, cloud consoles, payroll and HR systems. One wrong click there can affect everyone in the company, not just you.
  • Sensitive personal data. Health records, legal matters and customer files.
  • Anything you can't undo. Deleting records, publishing, or sending to a large list.

Use the sidebar for reading, comparing and drafting. Keep the final click for yourself.

Going deeper: for security and IT teams

Agent mode makes the browser profile a delegated identity. The agent acts with whatever sessions that profile holds, so its blast radius is set by the profile, not by the model. Build the controls around that.

Control which browsers exist at all. An unapproved agentic browser sidesteps every browser policy you have. As general practice, allow-list approved browsers in your MDM or application-control tooling and block other installs.

Microsoft Edge (Windows and macOS). The agent is governed by AllowBrowsingWithCopilot, supported from Edge 148. Enabled forces it on, disabled forces it off, and not configured leaves it off with users able to switch it on. It runs only on domains in BrowsingWithCopilotAllowList and is blocked on domains in BrowsingWithCopilotBlockList. An empty allow list effectively disables it. The policy works per profile and maps to the registry value of the same name under SOFTWARE\Policies\Microsoft\Edge (Microsoft Learn). The business version needs a Microsoft 365 Copilot licence and, per Microsoft, is offered worldwide except the European Economic Area (Microsoft Edge Blog). Don't rely on EdgeCopilotEnabled for desktops: Microsoft documents it for Edge on Android and iOS only (Microsoft Learn).

Google Chrome. Google's admin help names GeminiSettings as the switch for Gemini in Chrome (0 = Allow Gemini integrations, 1 = Do not allow Gemini integrations), and the Gemini app setting must also be on. Auto browse has its own policies: GeminiActOnWebSettings, scoped by GeminiActOnWebAllowedForURLs and GeminiActOnWebBlockedForURLs. Google says auto browse is off by default for managed users. The console path is Devices > Chrome > Settings > Generative AI > Gemini integrations (Google Chrome Enterprise Help).

What the agent can reach. Microsoft says its agent can't use autofill, saved passwords or the wallet, but can use cookies, so existing sessions carry over (Microsoft Support). It also pauses for user input before entering passwords or card numbers (Microsoft Edge Blog). Chrome's auto browse reaches every site the user can, signed-in ones included. Neither vendor page we used says how files the agent downloads are handled, so test that in a pilot. A logged-out run in a clean profile limits the damage to public pages. A logged-in run inherits every session cookie in the profile.

Threat model. The main agent-mode risk is indirect prompt injection: instructions planted in content the agent reads get treated as commands (explained here). The attacker only needs text in front of the agent. The prize is the user's authenticated sessions.

The Comet case shows the disclosure cycle. Brave reported it on 25 July 2025, Perplexity shipped a first fix on 27 July that failed retesting, and Brave published on 20 August, later noting the attack class still wasn't fully mitigated (Brave). A follow-up on 21 October 2025 showed near-invisible text in screenshots doing the same in Comet and visible page text redirecting the Fellou browser. Brave concluded that agentic browsing "will be inherently dangerous and should be treated as such" until the industry makes categorical safety improvements (Brave).

What to log and monitor. - Purview data loss prevention keeps enforcing policies, such as blocking copy and paste of sensitive data, while Copilot browses (Microsoft Edge Blog). - Chrome marks sites auto browse visited in history; Edge keeps screenshots of agent runs with the conversation for up to 30 days (vendor pages above). - In your identity provider, alert on high-impact changes made from browser sessions: new mail-forwarding rules, OAuth consent grants, payee or MFA changes.

Ask the vendor: how are user instructions separated from page content in the prompt? Which actions always need confirmation? Is there an admin-visible log of agent actions, and how long is it kept?

Key takeaways

  • An AI browser has two levels: a sidebar that reads and answers, and an agent mode that clicks and types on websites.
  • Agent mode can work inside sites you're already signed into, so the accounts in that browser profile set the stakes.
  • Vendors handle data differently: check what is sent, how long it's kept and whether memory is on.
  • A separate browser profile with no work accounts is a simple way to keep an agent away from things it shouldn't touch.
  • Banking, admin consoles and irreversible actions are jobs for you, not the agent.
  • IT can switch agent modes off or limit them to approved sites through Edge and Chrome enterprise policies.

Sources