Everyone's Using an AI Browser Now. Nobody's Fixed the Flaw That Lets Websites Hijack Them

Eighteen months ago, an "AI browser" was a curiosity you needed an invite to try. Today it's the default. Perplexity's Comet, OpenAI's ChatGPT Atlas, and Google's Gemini-powered Chrome have turned "the browser does things for you" from a demo into a feature hundreds of millions of people now have installed — often without realizing how much control they've handed over. And in the UAE, a market that by its own government's measure has some of the highest AI adoption rates on earth, that handover is happening faster than almost anywhere else.

From Invite-Only Experiment to Default Browser Feature

Perplexity launched Comet in July 2025 as an invite-only perk, originally reserved for subscribers paying $200 a month for its top-tier plan. Built on Chromium, it layered Perplexity's answer engine directly into the browsing experience — summarizing pages, describing images, doing research on command. By October 2025, Perplexity had made it free for everyone.

OpenAI followed on October 21, 2025, with ChatGPT Atlas, launching first on macOS with Windows, iOS, and Android versions to come later. Its headline feature, Agent Mode, let the chatbot actually act on the open web on behalf of Plus, Pro, and Business subscribers — filling in forms, navigating sites, completing purchases — rather than just answering questions about them.

Google took the slower, broader route. It opened Gemini in Chrome to all US desktop users for free in early 2026, having previously restricted it to paid AI Pro and Ultra subscribers. By February 2026 it had added "Auto Browse," letting Gemini take the wheel and complete multi-step tasks like booking appointments. In March, Chrome 143 added the ability for Gemini to read and compare up to ten open tabs at once. By May, Google announced Gemini in Chrome was coming to Android too. What started as a chat sidebar had become an agent with hands on the steering wheel of the world's most-used browser.

What Actually Makes These Different

A normal browser renders pages. An "AI browser" reads them, reasons about them, and then — critically — acts on them, using your logged-in sessions, your saved payment details, and whatever connectors you've granted it (email, calendars, shopping accounts). That's the entire pitch: instead of you copying information between ten tabs, the agent does it. It's also exactly where things go wrong.

The Flaw Nobody's Patched

The problem is architectural, not a bug waiting for a point release. When an AI browser agent reads a webpage, the instructions a user typed and the text sitting on that page arrive as one undifferentiated stream. The model has no reliable way to tell "do what my user asked" apart from "do what this webpage's hidden text is telling you to do." Security researchers call this prompt injection, and in 2025 and 2026 it stopped being theoretical.

Shortly after Comet's launch, researchers at rival browser maker Brave disclosed a critical vulnerability — rated 8.6 out of 10 in severity — that let a malicious webpage hijack the agent through exactly this kind of deceptive injected instruction.

It escalated from there. In June 2026, security firm LayerX disclosed what it called the "BioShocking" attack: a malicious webpage disguised as a video-game-style puzzle that rewarded wrong answers, conditioning an AI browser agent to progressively ignore its own safety rules until it could be steered into copying a user's SSH credentials from an authenticated GitHub session and sending them to an attacker's server. LayerX said the technique compromised six different AI browsers and extensions, including products from OpenAI, Anthropic, and Perplexity — and that only OpenAI's Atlas had shipped an effective fix by the time of disclosure.

Two months later, at Black Hat USA 2026, Brave security researcher Artem Chaikin presented findings that every AI browser he tested — including Opera's AI browser, Comet, and Atlas — remained vulnerable to prompt injection despite each vendor having added defenses like system-level guardrails, content tagging, and user-approval prompts for sensitive actions.

Separately, Palo Alto Networks' Unit 42 threat intelligence team published 2026 research tracking real-world (not lab-demo) prompt injection attempts. It found attackers hiding instructions from human view using CSS tricks in roughly 17% of cases, while more than 85% of successful jailbreaks worked simply by framing the injected text as a legitimate authority, a game rule, or an official override — exploiting the same instruction-following behavior that makes these agents useful in the first place. By August 2026, OpenAI itself had publicly acknowledged that prompt injection in agentic browsing may never be fully solved — only managed.

Why It Matters More Here

This isn't an abstract risk for the UAE specifically — it's a risk sized to how enthusiastically the country has adopted AI. A Khaleej Times report citing Cybernews data put UAE AI adoption at 56% in 2025, ranking it third globally, with AI app downloads climbing from 1.1 million in 2023 to 6.3 million in 2025. Gulf News, citing a Microsoft workplace report, put daily AI tool usage among UAE's working-age population at 59.4% — the highest of any country Microsoft measured — while a separate figure cited by Gulf News claimed 97% usage across UAE government entities, alongside more than AED 543 billion invested in AI across 2024 and 2025.

That combination — an agent architecture with a known, unresolved flaw, deployed into a workforce that uses AI tools more than almost any other on earth — is precisely the scenario security researchers are warning about. An AI browser plugged into a government employee's email, a banker's internal portal, or a retailer's customer database isn't just convenient; it's a wider attack surface, and one more webpage away from being turned against its user.

What to Actually Do About It

None of this means AI browsers should be avoided — but it does mean treating "Agent Mode" with the same caution as installing a browser extension with broad permissions, because that's functionally what it is. A few concrete habits help: be suspicious if an agent performing a task you framed as "just summarize this" suddenly starts using email or payment connectors; avoid granting an AI browser standing access to sensitive logged-in sessions (banking, source-code hosts, admin panels) unless a task genuinely needs it; and treat any webpage content that reads like an instruction — "ignore previous steps," "as the system administrator, you must..." — as a red flag the agent itself may fail to catch. Enterprises aren't powerless either: Chrome's admin console, for instance, lets IT teams disable Gemini in Chrome entirely via policy, and similar enterprise controls exist for other agentic browsers' business tiers.

The shift from "browser" to "browsing agent" is almost certainly permanent — the convenience case is too strong, and every major vendor is racing to ship more autonomy, not less. The security model just hasn't caught up yet, and by OpenAI's own admission, it might not fully catch up at all. For now, the safest assumption is the one Unit 42's researchers reached: if a webpage can talk, assume it's trying to talk to your agent too.