AI Browsers at Work: What Gartner, OpenAI, and the UK NCSC Actually Warned About

In August 2025, browser security engineers at Brave published a live exploit against Perplexity's agentic browser, Comet (Brave Security, Aug 20, 2025). A user opened a public Reddit page and clicked "Summarize this page." Hidden inside a collapsed comment sat white-on-white instructions ordering the assistant to switch to the user's open Gmail tab, read a six-digit one-time password (OTP), and post that code into a public Reddit reply. Because Comet ran inside the same authenticated profile as the user's email, the agent crossed tabs, bypassed login barriers, and stole the code with zero password prompts. Four months later, on December 22, 2025, OpenAI published a red-team post on ChatGPT Atlas showing how a poisoned email tricked a browser agent into sending a resignation letter to a user's CEO instead of drafting an out-of-office reply (TechCrunch, Dec 22, 2025).

Workplace risk spikes whenever convenience tools inherit live corporate sessions. In December 2025, Gartner analysts Dennis Xu, Evgeny Mirolyubov, and John Watts issued Cybersecurity Must Block AI Browsers for Now, advising enterprises to prohibit agentic browsers until hardened builds mature (The Register, Dec 8, 2025). That same day, the UK National Cyber Security Centre (NCSC) warned that language models act as "inherently confusable deputies" that cannot separate trusted commands from hostile web text (UK NCSC, Dec 8, 2025). In IBM's 2026 Cost of a Data Breach study (n = 602 breached organizations, vendor-sponsored Ponemon research), unapproved shadow AI tools figured in 43% of security incidents (Help Net Security, Jul 30, 2026).

Most coverage of Gartner's warning sits behind paywalls or speaks only to enterprise architects. You leave with why session cookies make AI browsers far riskier than chat tabs, what four primary disclosures proved, a three-tier decision rule, MDM blocklist settings, and The ed.cafe Isolated-Profile AI Browser Policy & MDM Blocklist Rules.

Why does an AI browser carry ten times the blast radius of a standalone AI chat tab?

Agentic AI browsers carry a far wider blast radius than standalone web chat tabs because an AI browser rides directly inside your authenticated session cookies across banking, payroll, electronic health records (EHR), email, and cloud admin consoles. Traditional web security relies on isolating one website tab from another; an agentic browser intentionally bridges every open tab under one autonomous operator.

For thirty years, Chrome, Safari, and Firefox enforced the Same-Origin Policy (SOP). Under SOP, a random recipe blog open in Tab 4 cannot reach over into Tab 1 to read your QuickBooks ledger, export your Gusto payroll sheet, or click "Approve Wire" inside your bank portal. Even if Tab 4 runs malicious JavaScript, the browser sandbox walls it off from Tab 1's HttpOnly session cookies.

Agentic browsers (OpenAI ChatGPT Atlas, Perplexity Comet, Opera Neon, The Browser Company's Dia, and Chrome extensions requesting <all_urls> plus debugger or scripting rights) dismantle that wall by design. To summarize tabs and fill forms, the browser agent sits above the Same-Origin Policy with two privileges:

1. Cloud context shipping: Sidebars scrape the Document Object Model (DOM) or screenshots of active tabs and ship that content to vendor clouds for inference, often capturing internal dashboards before a worker clicks "Ask."
2. Cross-origin cookie actuation: When the agent clicks buttons or fetches URLs, requests carry your live session cookies, saved passwords, and single sign-on (SSO) tokens.

Using a standalone AI chat tab is like sliding redacted photocopies through a locked bank teller window. Installing an agentic browser inside your work profile is like inviting that clerk behind the counter where every vault drawer stands unlocked.

Where that teller analogy breaks is forensic visibility. A human intruder behind a counter appears on ceiling cameras. When a hijacked AI browser clicks inside Gusto, Epic, or Google Admin, the server logs your laptop IP, your TLS fingerprint, and your multifactor cookie. Audit logs look identical to your own fingers clicking the mouse.

What did Gartner, OpenAI, Brave Security, and the UK NCSC actually say in late 2025?

Between August and December 2025, four independent technical sources converged on the same conclusion: no current filter reliably stops hidden webpage instructions from hijacking an authenticated browser agent. Reading all four primary statements side by side strips away both vendor hype and alarmist rumors.

First, Brave Security published two empirical disclosures. On August 20, 2025, Brave showed how hidden Reddit text hijacked Perplexity Comet across tabs to steal Gmail OTP codes (Brave Security, Aug 20, 2025). In October 2025, Brave disclosed "unseeable prompt injections" against screenshot-driven browsers like Comet and Fellou: faint background pixels invisible to human eyes that vision models read and obey as commands (Brave Security, Oct 2025).

Second, OpenAI issued blunt warnings around ChatGPT Atlas, launched October 21, 2025. CISO Dane Stuckey called prompt injection a "frontier, unsolved security problem," and OpenAI's December 22, 2025 post warned that prompt injection, like web social engineering, "is unlikely to ever be fully 'solved'" (TechCrunch, Dec 22, 2025). OpenAI urged users to run Atlas in logged-out mode and supervise active tabs.

Third, Gartner advised CISOs in December 2025 to block AI browsers for the foreseeable future (The Register, Dec 8, 2025). Gartner flagged four workplace hazards: active tab data streaming to vendor clouds, prompt-injection credential theft, wrong autonomous purchases, and staff pointing AI browsers at mandatory compliance training to click through quizzes unread.

Fourth, the UK NCSC explained the root math on December 8, 2025 in Prompt injection is not SQL injection (it may be worse) (UK NCSC, Dec 8, 2025; Computer Weekly, Dec 2025). Technical Director David C noted that parameterized SQL keeps commands and data in separate parser channels. Language models use one shared token stream. Defenders must restrict which cookies and tools the agent can touch rather than hoping filters catch 100% of attacks across millions of web queries.

Block, isolate, or allow with rules: how should a 10-to-200 person workplace decide?

Small and midsize organizations rarely need a blanket ban on every AI tool, but they do need a hard boundary between corporate session cookies and agentic web browsing. The ed.cafe Isolated-Profile AI Browser Policy sorts roles into three clear operating tiers and bans five irreversible tasks outright.

Choose the tier matching what sits on the laptop:

• Tier 1: Hard Endpoint Block (Finance, HR, Legal, Clinical & IT Admin Laptops). Workstations touching payroll, wires, HIPAA charts (45 CFR Part 164), Massachusetts resident SSNs or bank numbers (201 CMR 17.00), student records (FERPA), or Google Admin / Entra ID block standalone AI browsers (Atlas, Comet, Neon, Dia) and <all_urls> agent extensions completely. Staff use approved zero-retention chat tabs (Personal vs. Work AI Accounts).
• Tier 2: Zero-Cookie Isolated Sandbox (Public Web Research, Marketing & Grants). When analysts or grant writers benefit from summarizing 30 public PDFs or competitor pages, allow an AI browser only under strict isolation: Logged-Out Mode on, password managers removed, SSO blocked, and zero work email, Slack, CRM, or Drive logins ever opened in that browser.
• Tier 3: Standard Managed Browser + Copy/Paste (Default for Most Staff). Keep managed Chrome, Edge, or Safari for work logins, disable auto-scraping sidebars on internal hosts, and paste sanitized text into an approved chat tool (Prompt Injection for Office Workers).

Walk through a concrete example with assumptions stated:

• Assumptions: A 25-person outpatient clinic in Worcester, Massachusetts has 18 clinicians on an EHR portal, 3 billers handling claims and bank deposits, 1 HR manager, and 2 grant writers reading public state RFPs.
• Uncontrolled setup: Five staff install Comet and Atlas, click "Import from Chrome" (copying active EHR, Gmail, and Gusto cookies in one click!), and leave sidebars active. Opening patient charts streams unsecured PHI to unapproved clouds without a HIPAA Business Associate Agreement, triggering a 60-day federal breach review plus Massachusetts 201 CMR 17.00 risk.
• Tier 1 + Tier 2 setup: MDM blocks AI browsers across all 22 clinical, billing, and HR laptops (zero daily friction). The 2 grant writers get a Tier 2 logged-out profile blocked from *.clinicdomain.org via conditional access. Breach exposure drops to zero while RFP research stays fast.

Even inside Tier 2, five tasks stay permanently off-limits: (1) sending or deleting mail (5-Rung AI Agent Permission Ladder), (2) banking, wires, cards, or payroll, (3) HR, applicant screening (Hidden Instructions in Resumes and Forms), or clinical portals, (4) opening password vaults (1Password, Bitwarden), and (5) automating mandatory safety or phishing training.

How do small IT leads block or isolate agentic browsers on macOS, Windows, and Chrome without an enterprise SOC?

One technical trap catches small-business owners off guard: modern Chromium-based AI browsers install silently into a user's local profile directory on Windows (%LOCALAPPDATA%\Programs) or drag onto a Mac desktop without needing local administrator passwords. Blocking them requires four lightweight policy settings inside Microsoft Intune, Google Workspace Admin, Jamf, Kandji, or Mosyle.

Setting runtime_blocked_hosts inside Chrome Enterprise Core (free for any size team at admin.google.com) is one of the highest-leverage 15-minute fixes in small-business IT. Even an approved productivity extension is mathematically prevented by Chrome itself from reading or clicking inside *.gusto.com, *.quickbooks.com, login.microsoftonline.com, or your bank domain.

Copy-ready template: The isolated-profile AI browser policy and MDM blocklist rules

Copy The ed.cafe Isolated-Profile AI Browser Policy & MDM Blocklist Rules into your employee handbook and hand Part 3 to your IT lead or MSP. Pair this policy with our One-Page Small-Business AI Policy. In Massachusetts, No Worker Left Behind (Boston 501(c)(3), EIN 88-3268312) is forming ed.cafe Circle #1 at ed.cafe/start/, a free 30-chair cohort closing December 1, 2026 (pre-launch as of October 2026; zero cohorts completed yet), with open templates in the Staff Room.

THE ED.CAFE ISOLATED-PROFILE AI BROWSER POLICY & MDM BLOCKLIST RULES
For 10-to-200 Person Businesses, Clinics, Schools & Nonprofits | Publisher: ed.cafe

WHY THIS RULE EXISTS: Agentic AI browsers (ChatGPT Atlas, Perplexity Comet, Opera
Neon, Dia, and autonomous Chrome/Edge agent extensions) can read open tabs and click
buttons using your active login cookies. Hidden text on public web pages can hijack
these agents to read emails, copy login codes, or trigger unauthorized actions.

PART 1: WORKPLACE BROWSER TIERS (Default = Tier 1 or Tier 3 Unless Signed Below)
- TIER 1 (HARD BLOCK): Mandatory on all Finance, Payroll, HR, Legal, Clinical/HIPAA,
  Student-Record, and IT Admin devices. Zero agentic AI browsers or DOM-clicking
  browser extensions permitted. Use approved standalone web chat workspaces only.
- TIER 2 (ISOLATED RESEARCH SANDBOX): Written exception for public web research ONLY:
  [ ] NEVER import Chrome/Edge/Safari cookies, history, or saved passwords on setup.
  [ ] Run strictly in Logged-Out Mode; NEVER sign into work email, SSO, Drive, or Slack.
  [ ] Password manager extensions (1Password, Bitwarden, browser autofill) DISABLED.
- TIER 3 (STANDARD MANAGED BROWSER): Use managed Chrome/Edge/Safari for all work
  logins; disable auto-page-reading AI sidebars on internal, client, and financial tabs.

PART 2: FIVE TASKS NEVER DELEGATED TO AN AI BROWSER OR EXTENSION
1. Sending, forwarding, or deleting emails or calendar invites.
2. Banking, wire transfers, corporate card checkouts, invoicing, or payroll portals.
3. Opening EHR charts, HR files, candidate resumes, legal dockets, or client PII.
4. Unlocking password managers, MFA authenticators, or cloud admin consoles.
5. Completing mandatory workplace safety, compliance, ethics, or phishing training.

PART 3: 20-MINUTE IT / MSP CONFIGURATION CHECKLIST
[ ] 1. MDM Restricted Apps (macOS Jamf/Kandji/Mosyle & Windows Intune/AppLocker):
       Block unapproved user-path installs (`~/Applications`, `%LOCALAPPDATA%\Programs`)
       for `ChatGPT Atlas`, `Perplexity Comet`, `Opera Neon`, `Dia`, and `Fellou`.
[ ] 2. Chrome/Edge `ExtensionSettings` Policy (`admin.google.com` / Intune):
       Set default `ExtensionInstallBlocklist = ["*"]`; block unvetted extensions
       requesting `<all_urls>`, `debugger`, `scripting`, or `webRequest` permissions.
[ ] 3. Protected Host Denylist (`runtime_blocked_hosts` for ALL extensions):
       Add `["*://*.gusto.com/*", "*://*.intuit.com/*", "*://login.microsoftonline.com/*",
       "*://accounts.google.com/*", "*://*.yourbank.com/*", "*://*.yourehr.com/*"]`.
[ ] 4. Identity Conditional Access: Require managed Chrome/Edge/Safari for work SSO.

Exception Approved For (Tier 2 Role Only): _________________  By: __________________
Date: __________________  Quarterly Audit Date: __________________

Where this stops being true

Four boundaries determine when this policy shifts:

• Hardened enterprise builds will evolve: Gartner's December 2025 block guidance targeted consumer-first default builds ("for now"); reassess specific enterprise SKUs only when vendors ship isolated tab containers, zero-retention contracts, and hardware-enforced action gates.
• Managed Microsoft Edge Copilot differs from third-party agent browsers: Microsoft 365 E3/E5 tenants can govern Edge sidebar policies via Intune (HubsSidebarEnabled) under commercial data protection, though autonomous clicking modes still face prompt-injection risk (Is Microsoft Copilot Safe for Confidential Work?).
• Regulated sectors carry statutory rules: HIPAA entities, defense contractors (CMMC), broker-dealers (SEC Rule 17a-4), and Massachusetts contractors (Policy AI.001) must follow agency mandates and signed BAAs first.
• General operational information, not legal or audit advice: IBM's 2026 study (n = 602) is an observational vendor report; review endpoint controls with IT security specialists or counsel.

Questions people ask

Key terms

• Agentic AI browser: A web browser (ChatGPT Atlas, Perplexity Comet, Opera Neon, Dia) combining an LLM sidebar with autonomous authority to read open tabs, fill forms, and click links as the user.
• Confusable deputy: The UK NCSC's security term for a privileged AI assistant tricked by untrusted webpage or email text into misusing its legitimate access rights.
• Indirect prompt injection: Hidden or faint text embedded inside third-party web pages, PDFs, or images that hijacks an AI browser when the user summarizes or views the page.
• Logged-Out Mode: A browser agent setting where the assistant browses public pages without carrying the user's saved session cookies, passwords, or authenticated account state.
• runtime_blocked_hosts: A Chrome and Edge management policy specifying sensitive domains (like payroll, SSO, and banking) that browser extensions are blocked from reading or modifying.
• Same-Origin Policy (SOP): The classic browser security rule stopping one website tab from reading cookies or page data inside another website's tab.

Sources

1. Brave Security, "Indirect Prompt Injection in Perplexity Comet" (Aug 20, 2025): Brave Blog
2. TechCrunch, "OpenAI says AI browsers may always be vulnerable to prompt injection attacks" (Dec 22, 2025): TechCrunch
3. The Register, "Gartner recommends CISOs block AI browsers for the foreseeable future" (Dec 8, 2025): The Register
4. UK National Cyber Security Centre (NCSC), "Prompt injection is not SQL injection (it may be worse)" (Dec 8, 2025): UK NCSC
5. Help Net Security, "IBM 2026 Cost of a Data Breach Report: Unapproved AI in 43% of Incidents" (Jul 30, 2026, n = 602): Help Net Security
6. Brave Security, "Unseeable Prompt Injections in Screenshot-Based AI Browsers" (Oct 2025): Brave Research
7. Computer Weekly, "NCSC warns of confusion over true nature of AI prompt injection" (Dec 2025): Computer Weekly
8. IBM Newsroom, "2026 Cost of a Data Breach Study" (Jul 29, 2026, n = 602): IBM 2026