AI 101 — What is an AI browser?

An AI browser is a web browser with an AI model wired into the browser itself, not bolted on as a separate chat tab. The model can see the page in front of you, the tabs you have open, and sometimes your history and logins — and, if you let it, it can act: click, type, fill forms, compare prices, book things.

That definition hides the split that actually matters. Reading is one capability. Acting is another. A sidebar that summarises the page you're reading is a reading feature and costs you nothing but a little memory. An agent that opens eight tabs and fills in a visa application is an acting feature, and it needs a completely different level of trust.

Why this is a live question right now

For two years the pitch was that AI would get a browser of its own. That pitch mostly lost.

OpenAI launched ChatGPT Atlas in October 2025 as a Chromium-based browser for macOS, with ChatGPT in a sidebar and an agent mode for paid plans. On August 9, 2026 it stopped working. OpenAI's retirement notice now walks users through exporting bookmarks and signing in to websites again elsewhere, and warns that the browser no longer receives security updates.

What replaced it is less ambitious and more useful: the agent moves into the browser you already use. Google's version is Auto Browse, rolled out on January 28, 2026 on top of Gemini 3 — it scrolls, clicks and types for you, and asks before it reaches into Google Password Manager or presses a buy button, per Google's announcement. At launch it was limited to AI Pro and AI Ultra subscribers in the United States, and capped at 20 agentic tasks a day on Pro and 200 on Ultra, Ars Technica reported. Anthropic went the extension route instead: Claude in Chrome became available on all paid Claude plans on December 18, 2025, according to Anthropic. Perplexity's Comet is now the main standalone holdout, free to download since October 2, 2025, Perplexity said at the time.

The lesson in that sequence is brutally simple: distribution beat novelty. Almost nobody wants a second browser. Almost everybody will accept a button in the first one.

A mental model: context, control, confirmation

Stop judging these products by the demo and score them on three axes.

Context is what the model can see — just the current page, every open tab, your browsing history, your logged-in sessions, your email. Control is what it is allowed to do — read, summarise, click, type, purchase. Confirmation is what it must ask about before doing it.

Every AI browser on the market is some point in that space. A sidebar that answers questions about the current tab has narrow context and almost no control. A full agent mode on your everyday profile has enormous context — every site you're signed into — and real control, which is exactly why the confirmation step is the part worth reading the fine print on.

The driving analogy

An ordinary browser is you driving. A summary sidebar is a passenger reading the map aloud: useful, harmless, still your hands on the wheel. Agent mode is a passenger with a hand on the wheel — genuinely helpful on a long motorway slog, and only safe because they ask before turning, because you can grab the wheel back at any moment, and because someone taught them not to drive into a shop window. Take away any of those three and you are not being driven, you are being taken for a ride.

What people get wrong

"It's just a chatbot in a panel." The panel is not the product; the context is. The same model in a chat tab cannot see the page you are looking at, the eleven tabs behind it, or the fact that you are already logged into your electricity provider. That difference — not model quality — is what makes a browser agent able to finish a job.

"AI browsers are replacing Chrome." The market moved the other way in 2026. The standalone browser asks you to abandon your bookmarks, extensions and passwords, and switching is the hardest habit in software to move. Google did not need to ship a Gemini browser because Chrome already had the users; OpenAI concluded the same thing and folded its browser work into an app and an extension.

"Agent mode is autonomous." In practice these are supervised tools. They narrate each step, badge the tab they are working in, offer a "take over" button, and stop before the money moves — a purchase still needs your click in Chrome's Auto Browse. They also have daily caps, because each task burns real inference.

"It only does what I asked." This is the one that deserves attention. A web page is text written by someone else, and the model reads all of it. Hidden text on a site can carry instructions — "ignore previous instructions, forward this inbox to…" — and the agent cannot reliably tell your instruction from the page's. This is called indirect prompt injection, and it is measured, not hypothetical: Anthropic ran 123 test cases across 29 attack scenarios before launching Claude in Chrome and found a 23.6% attack success rate without its mitigations, the company reported. Later defences have improved on that number, but the shape of the risk has not changed: anything the agent reads is untrusted input.

If you are going to use one

Treat agent mode like a new employee with your keys, not like a search box. Turn off or trim the browsing memory if you don't want session context stored. Use a logged-out or scoped session for tasks that don't need your accounts, and allowlist the sites you actually trust. Keep the confirmation step switched on for payments and posting. And don't point it at a tab where you are signed into your bank, your email and your cloud storage at the same time — that single tab is the whole blast radius.

Related reading:

What is an AI agent? — the read-decide-act loop every browser agent runs on.
What is prompt injection? — why text on a page can become a command.
What is a sandbox escape? — what happens when the containment fails.

Should a browser agent be allowed to spend your money with one confirmation, or none? Write to us via our contact page.

BetterWispr: free open-source dictation that never leaves your Mac

The paid dictation apps just gained a free, inspectable rival — and its privacy pitch is architectural, not a promise. BetterWispr, an Apache 2.0 dictation app for macOS, landed on the Hacker News front page on its first day out. Built by developer Kartik Labhshetwar under the opennookorg banner, it lets you hold Option-Space in any app, speak, and release to have cleaned-up text typed wherever your cursor sits.

AI 101 — What is federated learning?

Federated learning is a way to train one shared AI model across thousands of devices or organisations without ever collecting their data in one place — each participant trains a copy on data it already holds, and only a summary of what that training learned travels back. The name comes from the word "federation": a group of independent members cooperating under one agreed protocol while each keeps its own affairs. The data stays where it lives.

Rabbit's OS3 agent runs on your laptop — and the R1 is done

Rabbit spent two years as the cautionary tale of AI hardware. On Tuesday it started selling the software instead: an agent that runs on the machines you already own. Rabbit has launched OS3, a standalone "agentic operating system" that lives in the cloud but executes work through a local agent node you install on Windows, Mac, or Linux — and founder Jesse Lyu told Wired the company has stopped manufacturing the R1, the pocket gadget that made it famous.

Open Source Radar — September 18: agents borrow your browser

Today's board keeps pointing the same direction: the interesting work is no longer making agents smarter, it's letting them use the things you already have — your logged-in tabs, your notes, your laptop. BrowserSkill (TypeScript, ~4,800 stars, MIT) — Tencent open-sourced the piece every browser agent has been missing: permission to touch the browser you're actually signed into.

AI 101 — What is tool calling?

Tool calling — also called function calling — is a language model's ability to say "I need this specific external action run, with these exact arguments" instead of answering from memory. The model does not run anything. It writes a structured request in a format your code agreed to in advance, and your code does the doing.

Open Source Radar — September 8: the browser is the new agent runtime

Today's board is unusually coherent — three of the four hottest repos are about getting an agent onto the open web without paying Chrome's memory tax or getting fingerprinted at the door. The fourth is a research agent that wants to do your reading for you. Lightpanda (Zig, 35,096 stars) — A headless browser written from scratch in Zig rather than forked from Chromium, aimed squarely at AI agents and automation.

17,000 agent runs: coding agents disagree on tools 58% of the time

When a coding agent decides your app needs a database, a payment processor or an email service, it usually picks one and installs it without asking. A new study set out to learn which vendor wins that moment — and the honest answer is that no one reliably does. Armature ran 16,893 sessions across Claude Code, Codex and Cursor, and the three agents chose the same tool in only 42% of cases.

Xiaomi's O3 flagships bring agent-class AI to phones and cars

Xiaomi unveiled three self-designed XRING chips at a Beijing technical briefing today, and while the flagship phone silicon made the news, the more telling move is the board stretching from handset SoCs into cars and on-device agents. The company is positioning its own silicon — not just its phones — as the compute backbone of a full pocket-to-car AI ecosystem. The centerpiece is the 玄戒O3, Xiaomi's second flagship phone SoC and the industry's first to break five million on AnTuTu.