What can an AI browser like ChatGPT Atlas do, and what are the risks?

An AI browser is a web browser with an AI assistant built into it, able to see the page you are on and, in some cases, act on it. ChatGPT Atlas, which OpenAI released on October 21 for macOS, is one example; Perplexity's Comet and The Browser Company's Dia are others, and Chrome and Edge are adding AI features of their own.

Atlas does three main things. A sidebar called Ask ChatGPT answers questions about the current page, so you no longer copy and paste text into a chat. Optional browser memories let ChatGPT recall details from sites you have visited and bring them up later. And agent mode, a preview for the Plus, Pro and Business plans, lets ChatGPT open tabs, click and type to complete a task for you.

The risks, as OpenAI describes them

OpenAI is unusually direct about the dangers. Its launch post says the agent can simply make mistakes, especially on complex workflows. It also warns that agents are vulnerable to prompt injection: instructions hidden in a web page or an email, written to override what you asked for. The result could be data taken from sites you are logged into, or actions you never intended.

OpenAI's chief information security officer, Dane Stuckey, went further in a public post the day after launch, quoted by the developer Simon Willison. He described attacks ranging from nudging the agent's opinion while it shops to tricking it into leaking email contents or credentials. Despite red-teaming, training the model to ignore malicious instructions and layered safeguards, he wrote that "prompt injection remains a frontier, unsolved security problem."

OpenAI has also put limits on the agent in Atlas. Inside the browser it cannot execute code, download files or add extensions, and it has no access to other apps or your files. On sensitive sites such as banks it pauses so that you are watching, a behavior Stuckey called Watch Mode.

Settings to check before you start

Deleting your browsing history also deletes the browser memories tied to it.

A worked example: a grocery cart, supervised

OpenAI's own example is a dinner party: give ChatGPT a recipe and ask it to fill a grocery cart. Here is a safer version of that request.

Here is a recipe for vegetable lasagna for 8 people. On the grocery site
that's already open in this tab, add every ingredient to the cart in the
quantities needed. Choose store-brand items when available.
Do not check out, do not change my account or delivery details, and do not
visit any other website. When you finish, list what you added with prices.
If something is out of stock, tell me rather than substituting.

1. Open the grocery site yourself and log in, so the agent works on a site you chose.
2. Start agent mode and stay on the tab. Watch which pages it opens.
3. Stop it if it leaves the store's site or opens anything unexpected.
4. Compare its list with the cart, then check out yourself.

Notice the shape of the request: one trusted site, one clear goal, explicit limits, and the final, irreversible step kept for you. Stuckey gave nearly this exact contrast: adding ingredients to a cart is a safer task than a vague request to go through your email and act on it.

How do you protect yourself from prompt injection on web pages?

You cannot see hidden instructions, so the defense is to limit what an attacker could gain. Start with logged-out mode: OpenAI recommends it whenever the task does not need your accounts, because an agent without your logins cannot leak what is behind them. Use logged-in mode only for well-scoped tasks on sites you trust.

Keep tasks narrow. A request that names one site and one goal gives a malicious page little room to redirect the agent; "review my emails and take whatever actions are needed" gives it a great deal. Never paste passwords, card numbers or other secrets into a task.

Supervise. Stay on the tab, especially on sensitive sites, and stop the agent the moment it does something you did not ask for, such as visiting an unrelated site or filling in a form you did not mention. Keep the final step of anything that spends money, sends a message or changes an account for yourself.

Finally, keep perspective. As Willison noted, defenses that stop most attacks still leave room for a determined attacker. An AI browser can save real time on routine browsing, but for now it works best as an assistant you watch, not one you leave alone.