Agentic browsers went from demo to production faster than security teams could react
Two years ago, a browser that could autonomously fill out forms, book flights, and navigate multi-step web workflows on your behalf was a research demo. In 2026, it's an enterprise deployment problem. Data security firm Cyberhaven found that 27.7% of enterprises now have at least one employee running an agentic browser in production, up from effectively zero at the start of last year — and in some organizations, adoption has reached 10% of the entire workforce.
Three products, three different bets
The category has consolidated around three serious contenders, each making a different architectural bet. OpenAI's Atlas, launched as a dedicated browser product in October 2025, centers on "Agent Mode" — tell it to find and compare flight prices to Tokyo, and it opens tabs, navigates airline sites, extracts pricing, and returns a comparison table without further input. Perplexity's Comet expanded into enterprise in March 2026, with an assistant that handles in-page research and summarization alongside autonomous multi-step tasks; IT administrators can push it silently across a fleet of managed macOS and Windows devices via MDM. The Browser Company's Dia takes a narrower approach, built around reusable "skills" scoped to specific tabs and pages, with memory tied to those skills rather than blanket browsing history.
The adoption numbers aren't evenly split. Cyberhaven's data shows Atlas has roughly 62x more corporate downloads than Comet — a gap that likely reflects OpenAI's existing enterprise relationships through ChatGPT more than any technical advantage of Atlas itself. Once an organization already trusts OpenAI with its documents and workflows through ChatGPT Enterprise, adding Atlas is a much smaller trust decision than starting fresh with an unfamiliar vendor.
The problem nobody has actually solved
Agentic browsers read and act on whatever content is on the page in front of them — which means malicious content embedded in a webpage can potentially manipulate the agent into taking actions the user never intended. This is prompt injection, and Cyberhaven's red team testing found it remains a serious, unresolved threat in production agentic browsers, Atlas included. A malicious page doesn't need to compromise the browser itself; it just needs to include instructions the AI agent will follow, hidden in text a human wouldn't notice but the model reads as part of its context.
For an agent with permission to fill forms, send emails, or move files, that's not a theoretical risk. It's the difference between a browser extension that reads a page and a browser extension that can act on your behalf with your credentials — and the industry has not converged on a reliable way to distinguish trustworthy instructions from injected ones embedded in arbitrary web content.
Why enterprises are adopting anyway
The rational response to an unsolved security problem is usually to wait. That's not what's happening. Employees are downloading agentic browsers faster than IT security teams can write policy for them — the classic shadow IT pattern, except this time the tool in question has direct write access to whatever the employee is logged into. Cyberhaven has separately tracked a 509% surge in what it calls "shadow AI" usage generally, and agentic browsers are simply the latest and most capable entrant into that category.
Security vendors are racing to catch up rather than block the trend outright — which is itself a tell about how entrenched agentic browsers have already become. Cyberhaven's own response, launched in 2026, includes tools to discover which agents are running on managed and unmanaged endpoints, reconstruct what those agents actually did during a session, and enforce runtime policies using data lineage rather than simple allow/block lists. A standalone browser extension extends the same monitoring to ChromeOS and unmanaged contractor devices — an acknowledgment that blocking agentic browsers outright isn't a realistic policy for most organizations anymore.
What this means if you're evaluating one
If your organization is going to have agentic browser usage regardless of official policy — and the adoption data suggests most already do — the practical move is visibility before restriction. Know which agents are running, what data they can touch, and what a compromised session actually looks like in your logs, before deciding which use cases to sanction and which to block. Treating agentic browsers as a binary allow/deny decision ignores that employees have already made the decision for you; the open question is whether security teams get visibility into what that decision actually does.