“It would be really nice to have a service that would just watch your life and actively help you when you needed it.” said OpenAI CEO Sam Altman in a recent Q&A interview about OpenAI's plans. This vision is at the heart of a new generation of AI browsers, notably OpenAI's ChatGPT Atlas and Perplexity's Comet.
AI browsers differ from traditional browsers in at least two important ways. The ubiquitous button in the top right corner of the screen brings up a chatbot that allows you to ask questions about the content you're viewing—for example, clarifying the article you're reading or explaining the image you're looking at.
You can also delegate entire tasks to the AI through agent mode, such as making changes to a Google Doc or making Amazon purchases on your behalf.
But convenience comes at the expense of privacy. “Atlas accesses much more information than other browsers, and the information Atlas accesses can be used to train OpenAI models,” says Lena Cohen, staff technologist at the Electronic Frontier Foundation. To answer questions about the website you visit, artificial intelligence browsers send personal data from the site to be processed on their servers. Examples include order history when you visit Amazon, or messages when you are on WhatsApp. Traditional browsers without artificial intelligence capabilities may store a list of URLs you visit, but they won't see what you view on those sites.
AI-powered browsers represent a “gold rush for user data in the browser,” says Or Eshed, CEO of LayerX, a browser security platform.
Here's what you need to know before you leave your web browsing in the virtual hands of AI.
Check what data you provide
When you access a chatbot through your browser's sidebar, you have less control over the data the AI receives than if you access the same chatbot through a website, since the sidebar automatically pins the site you're viewing for context.
OpenAI says the data obtained from the attached website varies. “Overall, the model has a good understanding of what it is looking for,” says Pranav Vishnu, product lead at Atlas. If you're viewing something visual, the AI model can get the image on the page. If you view an article, the model may only receive text. Browser Memory, an optional Atlas feature, goes one step further by storing descriptions of all the sites you visit, rather than just sending ChatGPT the site you're on when you interact with it.
However, users don't know exactly what parts of a website the AI receives or how it decides what it needs. To err on the side of caution, Atlas allows you to remove pages from the chat window (look for the “x” symbol when you hover over a website name in the chat window) or block certain websites from being sent to ChatGPT altogether via settings in the URL bar.
Perplexity does not have such controls. If you want to make sure that the content of the website you are on is not sent to the chatbot, open a new tab whose content is not private and access the sidebar – Perplexity will only attach the content of the tab you are currently on to the chat.
Disable model training
Atlas has two training settings. “Improve Model for Everyone” allows OpenAI to learn anything you ask or provide directly to ChatGPT, and is enabled by default. Because Atlas automatically adds the website you're on when you ask ChatGPT a question, this may include personal content from websites you visit, such as social media. OpenAI says it removes personal data before training, but does not specify how it decides what is considered private.
The second option, “Enable web browsing,” allows OpenAI to learn “the tabs you open, the links you click, including your browsing activity,” Vishnu says—essentially everything you do in your browser. Fortunately, this is disabled by default.
The safest option is to turn off “improve model for everyone” entirely, which OpenAI says will prevent it from learning from your chats or web browsing data.
Confusion speaks Comet data is stored locally on your computer. You can turn off data saving in the Settings panel on your Perplexity account page.
Remember: once they get your data, it's gone.
Not training doesn't actually change the data sent to OpenAI and Perplexity; it just limits what they can do with it.
“It's important for people to understand that once your sensitive data is on another company's servers, you have very little control over what happens to it,” Cohen says. “It can be misused in ways that most people don't even think about, whether it's a hacker or a government.” (Between January and June of this year, OpenAI completed with 105 requests for user data from the US government.)
Beware of rapid penetration attacks
The release of browsers with artificial intelligence was immediately accompanied by warnings agents who are hijacked attackers, such as those who steal users' banking information. These “rapid injection” attacks rely on the fact that A.I. bad differentiate between the content of the websites and media they visit and the instructions to follow. Attackers can hide malicious instructions on websites they control by writing text disguised so users can't see it, but AI agents can.
“Users should be careful when activating agent mode on unknown sites,” Eshed told TIME in an email. “Not all threats are immediately noticeable.”
To reduce this risk, Atlas provides a login/logout mode. When logged out, the agent does not have access to your personal data and accounts, reducing the risk of accidentally leaking something important. Perplexity doesn't have this option, which makes agent mode riskier.
Agentic browsing is “a very new, emerging field,” says Vishnu. “In general, we recommend that users start in logged out mode and offer the agent only the access required for a specific task.”
Or… just don't do it.
Bringing AI deeper into users' lives is an important part of AI companies' strategy. When it comes to AI-powered browsers, you can opt out.
“Machine learning mostly works by collecting data, so introducing it into new niches can help a lot,” says Dan Hendricks, executive director of the Center for AI Security. AI-powered browsing could be one such lucrative niche.
This also explains why artificial intelligence companies are keen not to be left behind. Even though products like agent mode in Perplexity and Atlas feel unfinished, the hope is that entering the market early will allow them to collect more data than their competitors. This allows companies to improve their product faster, creating a flywheel effect to attract more users and ultimately generate more revenue.
ChatGPT Atlas “continues to promote itself,” Hendricks says with a grin. “I have no desire to download.”
