How to Use AI Browser Agents Safely

An AI browser agent can act on sites where you are signed in, so a hidden instruction on a page could steer it. Use a separate browser profile with few sign-ins, keep approvals on, block sensitive sites, give it one small task at a time, and stay nearby while it runs. Do not leave it alone with your email or bank.

A browser agent is different from an AI extension that summarizes a page. It reads pages and then takes action: clicking buttons, filling forms and moving between sites. Our guide to AI browser extensions covers what extensions can see. This guide covers what happens when an AI can act.

These products move fast. OpenAI's Atlas browser, for example, has been deprecated, and its help pages now cover the shutdown. Check the current help page for anything you use, because steps here may change.

Why browser agents carry extra risk

Signed-in access

The agent often works in your session. If you are signed in to email, cloud storage or a shop, it may be able to act there too. That is what makes it useful, and it removes a barrier a website normally relies on: the idea that the person clicking is you.

Prompt injection

A page, email or document can contain text written for the AI, not for you. Brave's research on Comet showed that hidden page text could lead an assistant to act on a user's behalf. OWASP says no method reliably prevents prompt injection. Vendors add defenses, but a defense that usually works is not a guarantee.

Data leaving the browser

Tasks can send page content, history or open-tab context to the provider. Perplexity, for instance, says context used for a request is kept for up to 30 days. Read the policy for your tool.

Set up a safer environment

These steps work with any agent.

Create a separate browser profile for agents. Sign in only to the accounts the task needs.
Keep banking, health and admin accounts out of it. Do not store cards or passwords in this profile.
Turn off sync for that profile if you can, so your main passwords and history do not appear in it.
Use a work profile with admin rules for company tasks, not a personal one.
Connect fewer services. An agent connected to mail and calendar can reach far more than one that only browses.

How to set limits in common tools

Gemini in Chrome

Google's auto browse help page gives these controls for eligible personal accounts. It is rolling out gradually, and it may not be available to you.

Go to More > Settings > AI innovations > Gemini in Chrome.
Under Permissions, use Let Gemini browse for you to turn it on or off.
Review Sites Gemini can sign you in to, and remove any you do not want.

Google says Gemini asks for confirmation before steps such as sending messages, changing data and submitting forms, and asks you to take over to finalize payments. To end a task, click Stop, or close the task tab. Google notes that Gemini may try another way after you stop it, so check the outcome.

Comet

Perplexity's help page points to Settings > Privacy and security.

Use the Comet Assistant setting to allow or stop access to browser history, web navigation and site interaction.
Add sites to Block tasks on specific websites, such as your bank.
Approve connectors, such as Gmail, only when a task really needs them.

Claude in Chrome

Anthropic's permissions guide lists three modes in the menu on the chat input.

Use Manually approve, so Claude asks before each action.
Avoid Skip all approvals for anything that matters.
Open the extension's three-dot menu, choose Extension settings, and review Your approved sites. Revoke any you no longer need.

ChatGPT in Chrome

OpenAI's help pages describe a per-site prompt with options such as allow once, allow for a site, allow for all sites, or decline. OpenAI flags allow for all sites as higher risk. Choose allow once where you can. Review your site choices and blocklist in ChatGPT's settings. The location varies between the extension and the desktop app.

How to run a task safely

Write a narrow task. "Find three flights on this airline for these dates" is safer than "sort out my trip".
Name the sites to use, and tell it to stop if it needs anything else.
Read the plan when a tool offers one, before you start.
Stay nearby. Watch the first few steps, and step in if it goes somewhere unexpected.
Check every confirmation. Look at the recipient, amount and details, not just the button.
Do final steps yourself. Make payments, send important messages and accept terms by hand.
Check the result. Look at sent mail, orders and changed settings afterward.

Be extra careful when a task reads untrusted content, such as a public forum, a stranger's email or search results, while the agent can also reach private accounts. That combination gives an attacker the best chance. Split these into separate tasks if you can.

Rules for teams

Decide which agents are allowed, and for what.
Use admin controls. Chrome's policies, including GeminiActOnWebSettings, control auto browse on managed accounts, and Google says it is off by default for managed users.
Use Claude in Chrome's allowlist or blocklist, or similar controls, to limit sites. Start with a short allowlist.
Keep agents out of admin consoles, payroll and customer records.
Ask people to report odd behavior, without blame.

What to do if an agent does something wrong

Stop the task and close its tabs.
Review what changed: sent messages, purchases, new forwarding rules, account changes and downloads.
Revoke connectors and approved sites.
Sign out of the affected accounts and change their passwords.
Contact the site or your bank if money or data was involved.
Report it to the agent's maker, and tell your IT team if it involved work accounts.

Prycheck can list AI extensions across your browsers, so you can see which ones are installed and what they are allowed to reach.

Frequently asked questions

Are AI browser agents safe for banking?

It is best to keep them away from banking. Block those sites, and handle financial tasks yourself. Vendors add confirmation steps, but the risk of a wrong action is too high for the time saved.

Does logging out of accounts help?

Yes. An agent cannot use a session that does not exist. A separate profile with few sign-ins gives most of that benefit without logging out of your main browser.

Can I trust an agent's confirmation prompts?

They help, but read what they say. A prompt shows what the agent plans to do, and it may reflect a manipulated plan. Check the details against what you asked for.