Every major browser maker now wants to sell you an agent rather than a browser. Google’s Chrome has Auto Browse, Perplexity has Comet, and OpenAI has spent the past year cycling through Operator and Atlas in search of a product that sticks. The pitch is consistent across all of them: describe a task, walk away, come back to a finished job. The reality, based on the benchmarks and security research now available, is considerably messier — and worth understanding before you hand one of these tools your credit card or your inbox.
The headline number: around a 61% ceiling
For a while, AI browsing agents looked almost solved. On WebVoyager, a widely cited benchmark, top agents scored close to 90% success. But researchers found the test itself was not holistic — an agent did nothing more than google a query and click the first link scored 51%, meaning many “tasks” never required real navigation at all. That flaw prompted the creation of Online-Mind2Web, a stricter benchmark built from 300 verified tasks across 136 live, real-world websites designed to resist shortcut-taking.
Under that tougher test, dare I say valid test, the results were sobering. OpenAI’s Operator, the company’s first browser-controlling agent, topped the field with a 61.3% success rate — but almost every other frontier agent tested clustered near 30%, unable to beat SeeAct, a comparatively simple baseline system from January 2024. The underlying paper is dated April 2025, and newer entrants have reportedly nudged past Operator’s mark since, so 61% should rightly be read as a snapshot rather than a permanent ceiling. But this remains a fair description of where consumer-grade agentic browsing actually sits —it is a far cry short of the “just let it handle everything” promise.
One important caveat: no comparable third-party benchmark data exists yet for Perplexity’s Comet or Google’s Chrome Auto Browse specifically. Public benchmark coverage has concentrated on Operator, SeeAct, and various underlying models rather than on these packaged consumer products, so claims about their real-world completion rates remain largely unverified outside company marketing.
What each product actually does
Google’s Auto Browse, currently in preview for Google AI Pro and Google AI Ultra subscribers in the United States, works inside Chrome itself — opening and navigating tabs in the background while you carry on with other work. Google has built in friction points deliberately: Auto Browse pauses and asks for explicit confirmation before sensitive actions like making a purchase or posting to social media. Usage is capped too — AI Pro subscribers get 20 browsing tasks a day, AI Ultra subscribers get 200.
Perplexity’s Comet takes a lighter-touch approach through its Comet Assistant, which summarises emails and calendar events, manages tabs, and navigates pages on a user’s behalf. It launched in July 2025 as a limited release for $200-a-month subscribers before Perplexity made it free worldwide that October.
OpenAI’s approach has been the most turbulent. Operator launched in January 2025 as the company’s first browser-controlling agent, only to be deprecated seven months later when OpenAI shipped a broader “ChatGPT agent” capability. Its successor, ChatGPT Atlas, arrived in October 2025 with an “agent mode” pitched at genuinely multi-step commerce tasks — researching specs on one site, comparing prices on another, adding an item to a cart, and checking out. OpenAI CEO Sam Altman framed the ambition in sweeping terms, calling AI “a rare once-a-decade opportunity to rethink what a browser can be about.” But OpenAI’s own launch messaging was notably more cautious than Altman’s framing, warning plainly that Atlas “may make mistakes on complex workflows.”
That caution proved prescient. In July 2026, OpenAI announced it was sunsetting Atlas entirely, folding its agentic browsing features into ChatGPT’s desktop app and a Chrome extension instead. OpenAI’s help centre confirms Atlas has to stopped working as at 9 August 2026, it would be integrated into ChatGPT agent I July. — meaning that of the three products named as leaders of this race, one will have already been discontinued by the time many readers encounter this piece. It’s a useful reminder of how fast this category is moving, and how provisional today’s “pioneers” really are.
Where these agents still fail
Beyond raw task completion, the more pressing problem is security — and here the picture is genuinely alarming rather than merely unfinished. Independent testing LayerX, pitted ChatGPT Atlas against 103 real-world phishing sites and found it allowed 97 of them to proceed, a 94.2% failure rate. For comparison, the same test found that ordinary, non-agentic browsers fared far better: Microsoft Edge blocked roughly 53% of the identical attacks and Google Chrome blocked around 47%. An agent designed to click and act on your behalf, it turns out, can be considerably worse at recognising a scam than the browser it’s built on top of.
A separate University of Washington study, conducted in June 2026, tested seven popular agentic browsers and found that four of them — ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, and Perplexity Comet — created conditions allowing a malicious site to bypass the same-origin policy, a foundational web security boundary that normally stops one site from reading another’s data. These are to be included in the ” can make mistakes section.” Researchers built a working proof-of-concept against Atlas in which a page embedded inside a trusted site successfully stole information from that trusted site.
Nope, this isn’t a one-off bug. OpenAI has acknowledged research — including from Brave — warning that all AI-powered browsers remain vulnerable to indirect prompt injection, where malicious instructions hidden in a webpage trick an agent into acting against the user’s interests. OpenAI has been candid that this may never be fully “solved” in an absolute sense, rather its something to be continually patched in a future update.
The practical takeaway
None of this means agentic browsing has no future — it’s basically an early-stage technology being marketed with late-stage confidence. The gap between demo and reliable daily use is quite large: around 61% success rate on rigorous, realistic tasks means roughly two in five attempts still go wrong, and that figure comes from the best-performing product tested, not the average. Drop in a measured 94.2% phishing-detection failure rate and a same-origin-policy bypass affecting the majority of tested browsers, and the sensible posture for now is cautious, supervised use rather than full delegation.
That’s arguably why Google, Perplexity, and OpenAI have rightly all built in guardrails — confirmation prompts before purchases, daily task caps, warnings about complex workflows — Read those guardrails as an honest signal, its a work in progress. Let an agent draft a search or summarise a page by all means; think a bit more than twice before letting one log into your bank, click a link in an unfamiliar email, or complete a purchase unsupervised. The benchmarks and security audits agree on one thing: the tooling is improving quickly, but it hasn’t yet earned the trust its branding implies.
As at Sept 27- updated 78.7% benchmark- Online-Mind2Web
`
