Agentic Browsers Security Guide: Comet, Edge and Atlas

An agentic browser lets an AI model click, type and navigate inside the user's own logged-in sessions, so one malicious web page can turn every SaaS session in that browser into something the attacker can steer. This is a different risk class from AI browser extensions: the agent is built into the browser, sees every tab and acts with the cookies, single sign-on sessions and saved passwords already there. This guide covers the enterprise controls for the main products, Perplexity Comet, Microsoft Edge for Business with Copilot Mode, and OpenAI's ChatGPT Atlas (now retired, but still installed on some endpoints), together with the threat model, logging gaps, a hardening baseline and a rollout approach. It is for endpoint, identity and security architecture teams deciding whether to allow, scope or block these browsers. Product facts come from vendor documentation checked on 27 October 2026. For the general mechanics of browser and computer-use agents, see the Browser and Computer-Use Agent Guide.

Key takeaways

The session is the credential. An agentic browser does not need your password: it acts through cookies and SSO sessions the user already holds, so the blast radius is every application signed in within that profile.
Indirect prompt injection is the core threat. Brave's August 2025 research showed a hidden Reddit comment driving Comet to read an account email, trigger a one-time password, read it from Gmail and send both to the attacker.
Scope agents to an allowlist of sites. Edge's AllowBrowsingWithCopilot works only on domains in BrowsingWithCopilotAllowList, and Comet's Agent Permission Controls restrict websites and require approval for actions.
Logging is uneven. OpenAI's Atlas enterprise page listed no Compliance API logs or SIEM integration; Comet offers audit logs only above a seat threshold. Plan to log at the identity provider, proxy and SaaS layers.
Retired does not mean removed. OpenAI has retired Atlas and says uninstalling it should not be assumed to remove its cookies, memories or other data, so find and clean remaining installs.

How identity and access work in agentic browsers

A conventional browser keeps sites apart with the same-origin policy, and a human decides what to click. An agentic browser adds a model that reads content from any tab and issues clicks and keystrokes through the user interface. Origin isolation does not constrain it, because the agent acts as the user would. Three identity layers matter:

Browser sign-in identity: the account that licenses the AI features, for example an eligible Microsoft Entra ID for Edge for Business, a Perplexity Enterprise account for Comet, or a ChatGPT Business or Enterprise workspace account for Atlas.
Web session identities: cookies and tokens for every SaaS application the user is signed in to. These are what the agent actually uses to act.
Stored secrets: saved passwords, autofill and payment data. Edge's agent pauses for user input before entering passwords or card numbers, and Atlas exposed PasswordManagerEnabled as a managed preference.

OpenAI's design offered a "logged out" mode for Atlas agent runs to limit access to sensitive data and reduce the chance of acting as the user. The same principle applies to any agentic browser: run agent tasks in a separate profile with no privileged sessions. For session theft generally, see the Session Hijacking and Cookie Theft Guide.

Products and enterprise controls compared

Area	Perplexity Comet (Enterprise)	Microsoft Edge for Business (Copilot Mode)	ChatGPT Atlas
Status (27 October 2026)	Available on macOS and Windows	Copilot Mode available; agentic browsing with Copilot (Actions) in limited preview, Microsoft 365 Copilot licence, not in the EEA	Retired; no longer receives updates
Enable or disable	Admins can turn Comet off for all but a pilot group	Single Copilot Mode policy, moving to per-feature controls; `AllowBrowsingWithCopilot` for browsing with Copilot (version 148 and later)	Business on by default; Enterprise off until a workspace owner enables it; one Agent mode toggle covered ChatGPT and Atlas
Site scoping for the agent	Agent Permission Controls restrict websites and require approval for actions	`BrowsingWithCopilotAllowList` and `BrowsingWithCopilotBlockList`; an empty allowlist effectively disables the feature	No Atlas-specific allowlists or blocklists beyond sign-in control
Policy delivery	500+ Chromium policies through MDM; replace `com.google.Chrome` with `ai.perplexity.comet`	Group Policy (`MSEdge.admx`), registry `SOFTWARE\Policies\Microsoft\Edge`, macOS preferences	MDM host `com.openai.atlas.web` with a short list of supported keys
Data protection	No logging or training on enterprise data, per Perplexity	Purview policies such as copy and paste restrictions continue while Copilot browses; enterprise data protection with Entra ID	Some browsing data, memories and agent activity outside Enterprise retention and not region-pinned
Audit logging	Audit logs with 50+ Enterprise Pro seats or one Enterprise Max seat	Not described for agent actions in the source we read	No Compliance API logs, SIEM or eDiscovery integration
Assurance	Operates under Perplexity Enterprise SOC 2 Type II	Microsoft 365 commitments for EDP	Not in SOC 2 or ISO attestation scope

Admin roles and privileged access

Treat the ability to enable agent features as a privileged configuration, held by the same team that owns browser policy, and treat users with admin rights in SaaS consoles as the population that most needs agents kept away from their sessions.

Who switches it on: in ChatGPT workspaces the Agent mode toggle sat under permission settings; in Comet, the admin dashboard controls rollout and Agent Permission Controls; in Edge, policy owners in Intune or Group Policy. Require change control for each.
Privileged users: do not allow agentic browsing in profiles used for cloud consoles, identity provider admin portals, finance systems or production tooling. Put those domains in the agent blocklist and, better, use a separate hardened browser profile or a privileged access workstation. See the Privileged Access Workstations Guide.
Developer settings: remote debugging gives another process control of the browser. Atlas exposed RemoteDebuggingAllowed; for Chromium-based browsers set it off unless a team needs it.
Extensions: extensions add their own code to the same sessions. Use ExtensionInstallBlocklist set to * with an ExtensionInstallAllowlist, which Comet documents and Atlas supported. See the AI Browser Extensions Security Guide.

Integrations, API tokens and service accounts

Agentic browsers rarely use API keys of their own. Their power comes from what the browser already holds, plus any connectors the vendor offers.

Web sessions as tokens: SaaS session cookies and OAuth sessions are bearer credentials. Shorten session lifetimes for high-value applications, require re-authentication for sensitive actions and bind sessions to managed devices through conditional access. See the Conditional Access Guide.
Vendor connectors: Comet offers connectors to work applications. Each is an OAuth grant to a third party; review scopes and register them in your SaaS integration inventory.
Stored passwords and payment data: disable the built-in password manager where a corporate one exists (PasswordManagerEnabled is a standard Chromium policy and was supported by Atlas), and keep payment autofill off in work profiles.
Retired Atlas data: OpenAI's retirement article says Atlas cookies, memories and other Atlas-specific data are separate from ChatGPT, that uninstalling should not be assumed to remove them, and that users who exported passwords to a CSV file should delete it after import. Include those files in endpoint clean-up.

Threats and the controls that limit them

Threat	Example	Control
Indirect prompt injection from page content (MITRE ATLAS AML.T0051.001)	Hidden comment instructs the agent during "summarise this page" (Brave, Comet, 2025)	Site allowlist for agent actions; separate agent profile; user confirmation for sensitive steps
Cross-site action with the user's sessions	Agent reads a one-time password from webmail and uses it on another site	Block webmail and identity provider domains for the agent; phishing-resistant MFA that cannot be relayed as a code
Data exfiltration through URLs the agent loads (AML.T0086)	Data placed in a URL or image request, as in EchoLeak against Microsoft 365 Copilot	Secure web gateway categories, DLP on uploads and form posts, agent blocklists
Credential entry on lookalike domains	Agent follows a link to a trailing-dot or typo domain	Passkeys bound to origin; agent pause before password entry (Edge behaviour)
Unwanted transactions	Agent completes a purchase or sends an email	Approval for actions (Comet Agent Permission Controls); block payment and banking domains
Data retention outside policy	Browsing memories stored outside enterprise retention (Atlas)	Disable memories by policy or RBAC; exclude regulated data, as OpenAI itself advised for PHI and card data

Phishing-resistant authentication matters more once agents browse: a code-based MFA factor visible in webmail can be read and replayed by a hijacked agent, while a passkey is bound to the real origin. See the Passwordless and Passkeys Guide.

Logging and detection

Do not rely on the browser vendor for an audit trail of agent actions. Build detection from the layers you already control.

Inventory: use EDR or software inventory to find installs of Comet, Atlas and Edge versions with Copilot Mode, and record which users have them.
Identity provider logs: sign-ins from the browser's user agent, unusual sequences such as OTP or reset emails followed by sign-in from a new session, and consent grants to browser vendor connectors.
Secure web gateway or proxy: navigation bursts typical of automation, requests to newly registered domains, and form posts carrying data from internal applications.
SaaS audit logs: bulk reads, mailbox rule changes, sharing changes and outbound email created in short windows after an agent session.
Vendor logs where offered: Comet audit logs and telemetry; Edge Purview DLP events for AI-assisted workflows.

Metrics

Unmanaged installs: count of agentic browser installs outside the approved pilot, target zero.
Allowlist size: number of domains on the agent allowlist, reviewed quarterly; growth should be deliberate.
Privileged session exposure: admin users with agentic features enabled in the profile they use for admin portals, target zero.
Retired Atlas residue: endpoints still holding Atlas data directories after clean-up.
Phishing-resistant coverage: percentage of agent-pilot users on passkeys or hardware keys for the IdP.

Hardening baseline

Decide: block, scope or allow

Block where you hold regulated data and cannot get audit logs, or where users routinely hold admin sessions. Use application control to block the installers and executables, and the Edge policy left unconfigured or disabled.
Scope for most organisations: one approved product, a pilot group, a short domain allowlist for agent actions (for example travel booking and public research sites), and blocklists for identity, email, finance and admin consoles.
Allow broadly only when the vendor provides per-action approval, audit logs you can export, and DLP that covers agent actions. Small organisations without a SOC should usually stay at "scope".

Phased rollout

Discover: inventory installs and current use; remove retired Atlas installs and their data.
Policy baseline: push MDM or Group Policy for the approved browser: extension blocklist with allowlist, remote debugging off, built-in password manager off, idle timeout (Comet documents IdleTimeout and IdleTimeoutActions).
Scope the agent: in Edge set AllowBrowsingWithCopilot and populate BrowsingWithCopilotAllowList and BrowsingWithCopilotBlockList; in Comet configure Agent Permission Controls with site restrictions and approval for actions.
Pilot: 20 to 50 users without admin roles for four weeks; red team the pilot with injected pages against allowed sites. See the Red Teaming AI Agents for Identity Abuse guide.
Measure and expand: review detections and metrics, then widen in rings.
Rollback: disable the policy centrally (Edge policies support dynamic refresh; Comet allows turning Comet off for members), and revoke vendor connector OAuth grants.

Framework mapping

Control	NIST SP 800-53 Rev. 5	NIST CSF 2.0	Threat reference
Agent site allowlist and blocklist	AC-3 Access Enforcement; SC-7 Boundary Protection	PR.AA	AML.T0051.001; OWASP LLM01 Prompt Injection
Approval for sensitive actions	AC-6 Least Privilege	PR.AA	AML.T0053 AI Agent Tool Invocation; OWASP LLM06 Excessive Agency
Extension and feature restriction	CM-7 Least Functionality; CM-11 User-installed Software	PR.PS	n/a
DLP on agent workflows	SC-7	PR.DS	AML.T0086 Exfiltration via AI Agent Tool Invocation
Monitoring at IdP, proxy and SaaS	AU-2 Event Logging; SI-4 System Monitoring	DE.CM	All of the above

Common misconfigurations

Agent enabled in the everyday profile. The agent then shares sessions with email, the identity provider and admin consoles. Use a separate profile for agent work.
Empty or missing blocklists. Allowlists that include webmail, file sharing or the IdP give an injected instruction everything it needs for the Comet-style OTP attack.
Trusting a vendor fix as the control. Brave reported that Perplexity's first fix was incomplete and later re-reported the issue. Vendor mitigations help but do not replace scoping.
Assuming enterprise terms cover the browser. OpenAI's Atlas enterprise page said existing ChatGPT Enterprise compliance commitments did not apply to Atlas. Check each product's data and audit scope before allowing regulated work.
Leaving retired software in place. Atlas no longer receives security updates; any remaining install is an unpatched browser with stored sessions.
Code-based MFA for agent users. OTPs sent to email or SMS are readable by an agent that has webmail open; move pilot users to phishing-resistant factors first.

Practitioner checklist

Inventory agentic browser installs and remove retired Atlas installs and data.
Pick one approved product and block the others with application control.
Push managed policy: extension allowlist, remote debugging off, password manager off, idle timeout.
Restrict agent actions to an allowlist of domains and block IdP, email, finance and admin consoles.
Require user approval for purchases, sends and credential entry.
Keep privileged users off agentic browsing in admin profiles.
Move agent users to phishing-resistant MFA and shorten sessions for high-value SaaS.
Log at the IdP, proxy and SaaS layers, and ingest vendor audit logs where available.
Red team the allowed sites with injected content before each expansion.

Agentic Browsers Security Guide: Comet, Edge Copilot Mode and Atlas Controls for Enterprises