The Agentic Browser Shipped Before Its Seatbelt

In April 2026, browser agents — led by Perplexity's Comet and OpenAI's Atlas — accounted for roughly 71% of all observed agentic traffic on the web, per HumanSecurity's tracking. Comet alone was about 48% of it. In fifteen months these went from research demo to the default way a lot of people now browse. That's the fastest adoption curve I've watched in years. It's also the scariest.

Because the same month all that traffic was flowing, security researchers were taking these browsers apart.

The break-ins are not theoretical

This is the part that should make you sit up. A browser agent doesn't just read pages — it acts on your logged-in sessions. Your email, your bank tab, your password vault. And the attacks against that model landed fast:

• CometJacking / prompt injection. LayerX and Brave both showed that a hostile page can smuggle instructions into the agent — indirect prompt injection — and the agent obediently follows them instead of you.
• Zero-click hijack. Zenity Labs demonstrated agent takeover that needed no click at all: navigate to account settings, change the master password to an attacker-controlled value, exfiltrate the recovery material. Inside an authenticated session.
• Phished in under four minutes. Researchers got Comet to fall for a phishing scam in less time than it takes to make coffee.

These aren't edge cases dug out of a fuzzer over six months. They're the kind of thing that falls out the moment serious people look.

Why this is hard to "just fix"

Here's the uncomfortable bit, and OpenAI said it out loud: prompt injection is "unlikely to ever" be fully solved for agentic browsers. I think that's honest, not defeatist.

A normal browser's job is to not trust the page. An agentic browser's job is to read the page and act on it. You can't fully trust the content and fully act on it at the same time.

That tension is structural. The web is adversarial input by design — every page is untrusted data. The old browser security model spent twenty years building walls between a website and your machine. An agent's whole value proposition is to punch holes in those walls on your behalf. You're handing read-and-act power to a system whose input is, definitionally, written by strangers.

The courts noticed too

It's not just researchers. In the Amazon v. Perplexity fight, Judge Maxine Chesney granted Amazon a preliminary injunction on March 10, 2026, blocking Comet from operating inside password-protected Amazon accounts — finding Amazon likely to win on a federal Computer Fraud and Abuse Act claim. Oral arguments at the Ninth Circuit were set for June 11. Whatever you think of Amazon, the signal is clear: "my agent did it, not me" is about to get tested as a legal theory, and nobody knows where the liability lands.

My take

I use these tools. They're genuinely useful, and I'm not telling anyone to uninstall. But I treat an agentic browser the way I'd treat a sharp knife handed to a confident intern: fine for chopping vegetables, not for anything involving my actual money or credentials.

The honest framing is that we shipped the capability and are retrofitting the safety. That's the normal order of operations in this industry, and it's also how people get hurt in the gap. The fix isn't smarter prompts — it's architecture: scoped permissions, human confirmation on anything irreversible, and a hard wall between "read this page" and "act on my logged-in session."

Until that exists, the agent in your browser is a passenger you've handed the wheel to. Useful on the open road. I'd still keep my hands ready to grab it back.