AI Browsers in 2026: How Much Work Can They Do Beyond Search? Aside and Comet features, the Atlas shutdown notice, and the promise and security challenges of WebMCP

“Find three open slots on Thursday afternoon. Don’t send any invites.” The agent in the illustration above opens the calendar, reads 14 events, signs in without showing the password to the AI, picks three candidate times, and then stops to wait for approval. It is the kind of chore that usually means juggling three or four tabs yourself.

AI browsers no longer stop at summarizing pages. They compare information, fill in forms and draft emails. So can you trust one with your accounts? Gathering information is not the same as sending an email or making a payment: the permissions differ, and so does the cost of a mistake. The short answer: you can hand over real work, but anything hard to undo should wait for a human to approve it.

This article walks through Aside’s memory, permission settings and pricing to show how AI browsers work. It also covers what happened to Comet and Atlas, and WebMCP, a proposal that lets websites tell AI agents directly how to use their features.

01. How is an AI browser different from a regular browser?

What separates browsers is how deeply the AI gets involved in the work. Below are three types, from a regular browser to an AI browser that carries out tasks, plus one safeguard that can be added to any of them.

Some call this shift the Agentic Web: instead of people finding and reading pages, agents use website features while people set the direction and approve the results. In this article, “AI-native browser” is a descriptive label for products that put AI at the center of the work, not an official category.

02. How does an AI browser handle a request?

“Find me a hotel” is not a single search. A web agent breaks the goal into small steps, reads the screen, takes one action, and checks whether the result fits the goal before choosing what to do next.

03. Memory: using earlier work in the next task

An assistant you have to brief from scratch every time is not much of an assistant. That is why Aside puts memory up front. According to its official description, after each task Aside pulls out the people, companies and decisions involved and uses them in later tasks. When the agent gets stuck on a website, it also saves the path that worked. Aside calls this distilling process Dreaming.^[1]

Memory is stored on your device as Markdown files. You can see what was saved and where it came from, and fix anything that is wrong. Being able to inspect and correct memory matters more than how much of it piles up.^[2]

## Scheduling preferences
- Suggest morning slots first
- Ask before sending any invite## Site paths
- Internal dashboard: Reports → Monthly → CSV## Source: 2026-09-18 scheduling task

Storing memory on the device does not mean all AI processing happens on the device. Aside also connects to external AI services, so where memory is stored and where a model processes data are separate questions.^[6]

04. Sign-in and permissions: protecting passwords and approving actions are separate issues

To handle work behind a login, the AI needs a way into your accounts. That does not mean it needs your password.

According to Aside’s help center, its password manager fills saved credentials into the sign-in page without exposing the password value to the AI agent. Before autofilling, it also checks the password access policy and the target URL. Tools used in a task can be set to Allow, Ask or Deny.^[3][4]

Each new task starts in one of the three permission modes below, and when tool rules overlap, Deny takes precedence over Ask and Allow.^[4]

Here is the key point: letting an agent sign in is not the same as letting it do everything once it is in. Handing someone your house key does not mean you want them opening the safe. Beyond hiding password values, you still need to limit what the agent can read and do inside the account, and require your confirmation before important actions.

05. How are browser fees and AI model costs split?

When comparing AI browser costs, separate the fee for browser features from the cost of using AI models. Check what features and usage a plan includes, and whether separately connected AI services apply their own charges or usage limits.

Start with the browser plan. Aside’s plans differ in credits, automation routines, deep research and remote control. Below is the official pricing as of October 6, 2026.^[5]

For AI models, you can use the models included in your plan, connect a supported AI subscription you already have, or register your own API key. Connecting a subscription and using an API key are different arrangements: a connected subscription keeps that service’s usage limits and terms, while an API key means you pay the provider directly for what you use.^[6]

So connecting your ChatGPT subscription does not make every browser feature free of extra cost. Limits tied to the browser plan, such as credits and the number of routines, apply no matter how you connect a model.

06. Key AI browsers and their current status

AI browsers come and go quickly, so any status needs a date. The following was rechecked against official sources on October 6, 2026. This article focuses on Aside; for other products, it covers only the features and status confirmed on their official pages.

OpenAI moved its browser-based agent features into the ChatGPT desktop app and Codex, and pointed Chrome users to the ChatGPT extension and sidebar.^[12]

Then, at DevDay on September 29, OpenAI introduced dots, always-on agents that work on their own cloud computer and browser, starting with Pro and Business Premium users in supported regions. According to OpenAI, dots can sign in to supported sites without exposing saved passwords to the model, and users can set rules that allow, require approval for, or block specific actions. The design points the same way as Aside’s, but OpenAI itself notes that dots can make mistakes and tells users to always review consequential actions.

07. A 99% success rate: under what conditions?

297 out of 300. That is Aside’s published Online-Mind2Web result, a 99.0% success rate. The catch: it is Aside’s own run, with GPT-5.5 doing the tasks and GPT-5.4 grading them automatically.^[8] Online-Mind2Web is a benchmark built by Ohio State University researchers to test agents on real websites.^[17][18]

Do not read it as your own success rate. What the number means depends on which model ran the tasks, which tasks were chosen, and who judged success and how.

Use benchmarks to gauge what a product can do, but test the actual work you plan to hand over before adopting it. For tasks that are hard to undo if done wrong, evaluate approval steps and recovery options, not just the success rate.

08. WebMCP: websites tell AI how to use their features

An agent that operates the screen has to inspect buttons and fields and guess what each one does. The Web Model Context Protocol (WebMCP) flips this around: the website itself declares, in a structured format, which features it offers and what inputs they need. Instead of guessing at the screen every time, the agent can call the tools the site has defined.^[19]

Developers can register tools in JavaScript or annotate HTML forms to turn them into tools. Chrome’s official docs describe WebMCP as a proposed web standard that sites can try through an origin trial (an opt-in preview before launch) starting in Chrome 149. It was still at that stage on October 6, so it is not available in every browser or on every site.^[20][22]

// Mark this as a hard-to-undo action
await document.modelContext.registerTool({
  name: 'book_flight',
  description: 'Book a flight with confirmed details.',
  inputSchema: { type: 'object', properties: { flightId: {…}, passengers: {…} } },
  annotations: { readOnlyHint: false, consequentialHint: true },
  execute: async ({ flightId, passengers }) => { /* booking logic */ },
});

Tools can also carry labels: read-only, returns outside data, or has significant consequences. Chrome’s docs say that when a tool carries consequentialHint, a browser or agent can request user confirmation before running it. The label is a signal, not a lock; whether approval is actually required depends on how the browser and agent implement it.^[21]

There are limits. Chrome’s docs say WebMCP is designed mainly for browser work with a person in the loop, not headless automation. By default, cross-origin iframes cannot register tools, and an agent has to visit a site directly to discover what tools it offers.^[19]

09. Challenges AI browsers still face: bot blocking and security

Better features do not remove two walls: websites that block automation, and malicious instructions hidden in web pages.

Bot blocking: verifying identity instead of evading detection

Many websites filter automated traffic with web application firewalls (WAF) and bot detection, and show a CAPTCHA when a visit looks suspicious. That is usually where an agent’s task stalls. There are two main responses.

Verified identity does not guarantee access to every site. Site owners can still block all bots, allow only verified bots, or allow specific bots on specific paths. The signing method is an IETF draft and may still change.^[24][26]

Indirect prompt injection: malicious instructions hidden in web pages

Indirect prompt injection is an attack in which malicious instructions are hidden in web pages, documents or emails so that an AI changes its behavior when it reads them. Text people cannot see can still affect a model that reads it. The Open Worldwide Application Security Project (OWASP) kept prompt injection in first place (LLM01:2026) in the 2026 edition of its top 10 risks for large language model (LLM) applications, released in August 2026.^[27]

Both quotes point the same way. Instead of expecting the model to filter out malicious instructions on its own, use product settings to limit what runs automatically and put human approval in front of high-impact actions. The end of the next chapter turns this into a concrete settings example.

10. Getting started: choosing a product and setting permissions

Rather than handing over everything at once, narrow access and start with tasks whose results are easy to check. The quick check and checklist below can help you decide which product and approach to start with, and the end of this chapter shows one concrete permission setup.

When choosing a product, first check whether you can actually set up this kind of split and review the approval history afterward. Handing work to an AI browser is already possible. The real homework is deciding where it has to stop and ask.

Quick questions

How is an AI browser different from a chatbot in the sidebar?

A chatbot mostly summarizes pages and answers questions. An AI-native browser tries to take actions such as searching, typing and comparing across several sites to reach your goal. Permissions and approval flows vary widely by product, so check the actual approval process rather than the feature name.

Does Aside run completely offline?

You can’t assume that. It says memory is stored on your device as Markdown files, but it also connects to plan models, ChatGPT or Claude subscriptions, and API keys. Which requests reach a model provider depends on the model and settings you choose.

Can I still use ChatGPT Atlas?

OpenAI announced the Atlas shutdown on July 9, 2026, and set August 9, about 30 days later, as the scheduled stop date. After that date, it says, Atlas may no longer open, browse or run agent tasks. Browser agent features moved into the ChatGPT desktop app and Codex, and Chrome users are pointed to the ChatGPT extension or sidebar.

Does WebMCP eliminate prompt injection?

No. WebMCP is a proposed standard that lets websites tell agents about their tools and input formats. Risk hints can prompt confirmation, but they can’t fully block malicious instructions in external data. Least privilege and human approval are still needed.

Keep exploring