“It’d be really nice to have a service that was sort of just observing your life and proactively helping you when you needed it,” said OpenAI CEO Sam Altman in a recent Q&A about OpenAI’s plans. This vision is at the heart of a new crop of AI browsers, notably OpenAI’s ChatGPT Atlas and Perplexity’s Comet.
AI browsers differ from traditional browsers in at least two important ways. An omnipresent button in the top right corner of the screen summons a chatbot, allowing you to ask questions about the content you’re viewing—clarifying the article you’re reading, or explaining the image that you’re looking at, for example.
[time-brightcove not-tgx=”true”]
You can also delegate whole tasks to the AI through an agent mode, such as making changes to a Google doc or doing Amazon shopping on your behalf.
But the convenience comes at the expense of privacy. “Atlas is getting access to a lot more information than other browsers, and the information that Atlas accesses can be used to train OpenAI’s models,” says Lena Cohen, a staff technologist at the Electronic Frontier Foundation. In order to answer questions about the website that you’re visiting, AI browsers send personal details from the site for processing on their servers. Examples include order histories when you’re visiting Amazon, or messages when you’re on WhatsApp. Traditional browsers without AI features might store a list of the URLs that you visit, but they don’t see what you’re viewing on those sites.
AI browsers represent a “gold rush into user data in the browser,” says Or Eshed, CEO of LayerX, a browser security platform.
Here’s what to know before you put your browsing in the virtual hands of the AI.
Check what data you’re providing
When you access a chatbot through a browser sidebar, you have less control over the data the AI receives than when you access the same chatbot through a website, as the sidebar automatically attaches the site that you’re viewing for context.
OpenAI says that the data retrieved from the attached website varies. “In general, the model is smart about what it’s looking for,” says Pranav Vishnu, the product lead for Atlas. If you’re browsing something visual, the AI model might retrieve the image on the page. If you’re browsing an article, the model might only get the text. Browser memories, an optional feature in Atlas, take this a step further, storing a description of all of the sites that you visit, instead of just sending ChatGPT the site you’re on when you interact with it.
However, users aren’t privy to exactly which parts of the website the AI is retrieving, or how it decides what it needs. To err on the side of caution, Atlas lets you remove pages from the chat window (look for the “x” when you hover over the website name in the chatbox) or block certain websites from being passed to ChatGPT altogether through the settings in the URL bar.
Perplexity doesn’t have the same controls. If you want to be sure that the contents of the website you’re on aren’t being sent to the chatbot, open a new tab where the contents aren’t sensitive and access the sidebar there—Perplexity will only attach the contents of the tab you’re currently on to the chat.
Turn off model training
There are two training settings in Atlas. “Improve the model for everyone” allows OpenAI to train on anything that you ask or provide to ChatGPT directly, and is on by default. Since Atlas automatically appends the website that you’re on when you ask ChatGPT a question, this could include the personal contents of websites that you visit, such as social media. OpenAI says that it scrubs personally identifiable data before training, but doesn’t specify how they decide what counts as personal.
A second option to “Include web browsing” allows OpenAI to train on “tabs that you open, links that you click through, just generally including your web browsing activity,” says Vishnu—basically, everything that you do in your browser. Mercifully, this is off by default.
The safest option is to disable “improve the model for everyone” altogether, which OpenAI says will prevent it from training on your chats or your web browsing data.
Perplexity says that data from Comet is stored locally on your computer. You can turn off data retention in the “Preferences” pane of the Perplexity account page.
Remember: Once they have your data, it’s gone
Opting out of training doesn’t actually change the data that’s being sent to OpenAI and Perplexity; it just restricts what they can do with it.
“It’s important for people to understand that once your sensitive data is on another company’s servers, you have very little control over what happens to it,” says Cohen. “It could be misused in ways that most people aren’t thinking about, whether it’s by a hacker or by a government.” (Between January and June this year, OpenAI complied with 105 requests for user data from the U.S. government.)
Watch out for prompt injection attacks
The release of AI browsers was immediately accompanied by warnings of agents being hijacked by bad actors, such as those stealing users’ banking data. These “prompt injection” attacks rely on the fact that AI agents are bad at distinguishing the contents of the websites and media that they visit, and instructions to follow. Attackers can hide malicious instructions on websites they control by writing text disguised so that users can’t see it—but AI agents can.
“Users need to be cautious about activating agentic mode on unknown sites,” Eshed told TIME in an email. “Not all threats are immediately visible.”
To mitigate this risk, Atlas has a logged-in and logged-out mode. In logged-out mode, the agent doesn’t have access to your personal data and accounts, which reduces the risk that it could accidentally leak something vital. Perplexity doesn’t have this option, which makes its agent mode riskier.
Agentic browsing is a “very fresh, evolving field,” says Vishnu. “We recommend, generally, that users start with logged-out mode and only offer as much access as is required for a given task to Agent.”
Or… just don’t do it
Embedding AI deeper into users’ lives is an important part of AI companies’ strategy. When it comes to AI browsers, you can opt out.
“Machine learning proceeds by sort of scavenging for data, largely, so forcing it into some new niches can help a lot,” says Dan Hendrycks, executive director at the Center for AI Safety. AI browsing has the potential to be one such lucrative niche.
This also explains why AI companies are anxious not to be left behind. Even if the products such as the agent mode in Perplexity and Atlas feel half-baked, the hope is that getting into the market early will collect more data than their competitors. This allows the companies to improve their product faster, generating a flywheel effect to attract more users—and eventually generate more revenue.
ChatGPT Atlas “keeps advertising itself,” says Hendrycks with a chuckle. “I feel no inclination to download.”