AI Browser Agents in 2026 - What ChatGPT Atlas and Perplexity Comet Mean for Data Collection and Proxies

By Elena Park · 2026-07-26 · 12 min read · News

AI browser agents went mainstream in 2026 - Atlas and Comet alone cross 10 million users. Here is what this means if you run a website, collect web data, or are deciding whether to trust one with your accounts.

The agentic browser boom, in real numbers

Agentic browsers crossed 10 million combined monthly active users in early 2026, according to Similarweb data. Perplexity Comet reached roughly 3 million MAU and ChatGPT Atlas crossed 5 million MAU as of Q1 2026. Distribution expanded rapidly through the quarter: Comet completed its rollout across iOS, Android, macOS, Windows and iPad, while Atlas shipped broadly to ChatGPT subscribers with Operator-style Agent Mode built in.

This is not a niche developer trend anymore. Microsoft turned on Copilot Mode in Edge for hundreds of millions of existing seats, Anthropic added Claude to Chrome, and Google's Chrome auto-browse feature is expanding from a US desktop feature to the OS level on Android, shipping on Pixel 10 and Galaxy S26 handsets in June 2026. An AI agent controlling a browser on a user's behalf - reading pages, filling forms, comparing products, completing multi-step tasks - has moved from demo to default feature across most major browser vendors within about two years.

Capability has scaled alongside distribution. Claude Sonnet 4.6 reached 72.5% on the OSWorld benchmark in February 2026, close to the rough ceiling of human performance on that specific test, and Comet's agent mode runs on Sonnet 4.6 by default. OpenAI's Operator trails at 38.1% OSWorld but has shown fast month-over-month improvement. Researchers have cautioned that headline benchmark scores can be gamed, so real-world shipped behavior remains the more reliable signal than leaderboard numbers alone.

The real security risk: indirect prompt injection

The most-discussed technical vulnerability in this category is indirect prompt injection - malicious instructions embedded in a webpage's content that an AI agent reads and follows as if they were the user's own instructions, since the agent cannot always reliably distinguish between the two. A widely-circulated security research thread on this exact issue for Comet drew significant attention in the developer community; Perplexity has since shipped mitigations, but the fundamental architectural challenge remains unresolved across the category, not specific to any one product.

Comet was also affected by a separate vulnerability, patched in August 2025, before this most recent wave of scrutiny. Enterprise deployments increasingly ship with per-action confirmation layers and admin-configured controls - Perplexity's enterprise security work was done in partnership with CrowdStrike - precisely because letting an autonomous agent take unsupervised action inside a logged-in browser session is a materially different risk profile than a chatbot that only produces text.

The practical takeaway for anyone using these tools: review exactly which accounts and data you grant an agentic browser access to before trusting it with anything sensitive, and treat 'autonomous multi-step task completion' claims with the same caution you would apply to any new category of software handling your credentials and payment methods.

What this means if you run a website

Agentic browser traffic is a genuinely new category, distinct from both human visitors and traditional crawlers, and it does not fit cleanly into either bucket. When Comet or Atlas visits your site on a user's behalf, the request often originates from the user's own IP address and browser, behaving like a real visit - but the actual 'visitor' making decisions is an AI system reading and acting on your content, not a person scrolling and clicking directly.

This connects directly to the crawler classification challenge Cloudflare is now formalizing with its September 2026 policy changes (covered in depth elsewhere on this site): the difference between a training crawler, a search crawler, and a user-initiated agent fetch matters, and agentic browsers like Atlas and Comet fall squarely into that third, user-initiated category - generally the one site owners have the least reason to block, since a human is actively directing the session in real time.

Practically, this means your site's usability for AI agents is becoming a real consideration alongside human UX and SEO. Sites that rely heavily on unlabeled buttons, infinite scroll without pagination, hover-only interactions, or heavy client-side rendering without accessible markup create the same friction for AI agents that they create for screen readers - and as agentic browsing scales, that friction increasingly costs real traffic and completed transactions, not just accessibility compliance.

What this means for proxies and data collection specifically

Consumer agentic browsers like Atlas and Comet are built for individual, logged-in personal use - they are not designed as scraping infrastructure and generally route through the user's own network rather than a proxy pool. For anyone trying to run agent-style automation at scale rather than as a single personal assistant, the same infrastructure requirements documented throughout this site still apply: residential or mobile proxies for IP diversity, and increasingly agent-aware automation frameworks rather than consumer browser products.

The emerging self-hosted alternative worth watching is tools like OpenClaw, which let developers run a personal agent on their own infrastructure with data-source integrations including Firecrawl for live web data - a meaningfully different category from Atlas or Comet, closer to a developer automation framework than a consumer browsing assistant, and one where proxy infrastructure choices matter in the same way they do for any other automated data collection pipeline.

Frequently Asked Questions