Is it safe to let an AI browse the web logged in as me?
AI browsers see what you see, including what attackers hide.
AI browser (or browser agent): a web browser with an AI built in that can click, type, scroll and move between pages for you. ChatGPT Atlas, Perplexity Comet, Opera Neon and Fellou are examples.
You say "find me a flight under £300 and add it to my basket" and it goes off and does it, using your logged-in accounts.
Your browser is where you're logged in to everything: email, bank, work tools, shopping.
So an AI browser starts with all three ingredients from "The lethal trifecta: how AI can leak your data":
That's the dangerous combination by default.
Comet lets you take a screenshot of a page and ask the AI about it.
In October 2025, researchers at Brave hid instructions in an image using faint light-blue text on a yellow background. A person looking at it sees a yellow box. The AI reads the text and treats it as commands.
This was the same browser as the Reddit attack in "The lethal trifecta: how AI can leak your data". It was a different door into the same house.
In the Fellou browser, Brave found that simply asking the AI to go to a website was enough. The browser sent the page's content to the AI, and instructions written on the page could take over.
You didn't need to ask it to summarise anything. You just needed to send it there.
Brave reported the issues to each company. Their conclusion was that this isn't one browser's bug. It's a problem for the whole category.
When OpenAI launched Atlas, it added two safety features:
Simon Willison thinks logged-out mode is the strong one. Watch mode is like a car that drives itself as long as you keep your hands on the wheel. It only works if you're really watching.
In July 2026, researchers showed an attack on Copilot in Microsoft Word.
Hidden instructions in a source document made Copilot change the new document it was writing, and copy the hidden instructions into it. Anyone who later used that new document with Copilot passed the instructions on again.
Worm: an attack that copies itself from one place to the next without the attacker having to do anything more.
It was reported to Microsoft, who had 144 days to fix it. When Simon Willison wrote about it, there was still no fix for the whole class of attack.
Use logged-out mode or a separate browser profile for AI browsing. Keep it signed out of your email and bank.
Treat "summarise this page" as risky when you're logged in. The page gets to talk to an assistant that holds your keys.
Don't let it act unattended on sensitive sites. If it's buying, sending or changing settings, watch every step.