> ## Content Index
> Fetch the complete content index at: https://genius-marketing.ghost.io/llms.txt
> Use this file to discover other available public pages before exploring further.

# An Assistant That Can Click Is a Different Thing From One That Can Talk
- URL: https://genius-marketing.ghost.io/an-assistant-that-can-click-is-a-different-thing-from-one-that-can-talk/
- Published: 2026-09-27T11:40:56.000Z
- Updated: 2026-09-27T11:40:56.000Z
- Author: Genius Marketing

For three years the deal with an AI assistant was simple: it read, it wrote, and you did everything else. Then the browser makers handed it a mouse. Ask one of the current crop to find a replacement part and order it, and it will open tabs, read pages, fill in the form and stop just short of pressing buy.  
  
That is a real jump in usefulness, and it comes with a new question. The assistant is operating inside your logged-in browser, which means it is operating as you.

### Look Behind the Curtain

The field settled quickly and then churned. Perplexity's Comet has been available worldwide since late 2025, with a free tier. Anthropic's Claude for Chrome went generally available at the end of August 2026 on its paid plans. Google is rolling out agentic browsing in Chrome through Gemini, in US preview for paid tiers, and Microsoft has its own version in Edge. OpenAI's standalone Atlas browser was retired in August 2026 and its agent capabilities folded back into the ChatGPT app, which tells you how unsettled this still is.  
  
What they share is architecture. The agent reads the page the way you do, then acts on it. It inherits your session, so it is already signed in to your email, your bank and your shopping accounts. It does not ask a website for permission, because as far as the website is concerned, it is you.  
  
That creates a problem with a name: indirect prompt injection. The agent cannot cleanly tell the difference between your instruction and text it finds on a page. A hidden line in a product review, a forum post, an email or an iframe you never noticed can read as a command. Google has called this the main new threat facing every agentic browser. OpenAI has described the attack surface as effectively unbounded. Anthropic describes its own defenses as a moving target rather than a solved problem.  
  
Researchers have shown it working. Brave demonstrated hijacking Comet through page text in 2025, then a nastier version where faint text in an image, invisible to a person, is read by the agent when the user takes a screenshot. That one hit several products at once.  
  
None of which means the tools are unsafe. It means their failure mode is unfamiliar, and it is not the browser being hacked. It is the browser being persuaded.

### The Capability Multiplier

The control available is better than the threat sounds, because every vendor shipped the same levers and most people never touch them.  
  
The first is scope. The agent does not need to be signed in to do most of what you want. Comparison shopping, research, pulling details off a dozen pages, summarizing a long document: none of that requires your accounts. Running it logged out, which OpenAI explicitly recommends for tasks that do not need a session, removes the entire category of damage where something goes wrong inside your email or your bank.  
  
The second is confirmation. All the major implementations pause before consequential actions: buying something, sending a message, signing in. That pause is the product working correctly, not an inconvenience to click through.  
  
The third is narrowness of instruction. The broad request is what makes injection dangerous. Tell an agent to go through your inbox and handle whatever needs handling, and any message in that inbox can write your next instruction. Tell it to find the tracking number in the message from the courier and report back, and a hostile email has almost nothing to work with. OpenAI's own guidance says exactly this: avoid sweeping open-ended prompts.  
  
People who set these boundaries early get most of the benefit at a fraction of the exposure, and the boundary takes about ten minutes.

### The Sovereign Action

Ten minutes before you hand the mouse over.  
  
\- Decide what the agent is for. Research and comparison work logged out covers most of the value and almost none of the risk.  
  
\- Use a separate browser profile for agent work, signed in to as little as possible. Keep banking and primary email out of it entirely.  
  
\- Keep instructions narrow. One task, one destination, one thing to report back.  
  
\- Read every confirmation prompt instead of clicking through. That prompt is the only place a hijacked instruction becomes visible.  
  
\- Set a domain allowlist or per-site permissions where the product offers them, and remember that any site the agent visits gets the same camera, microphone and location access it would get from you.

![](https://storage.ghost.io/c/e5/b8/e5b8348a-6320-40d1-aa0f-5986247da086/content/images/2026/09/ai-browser-agents-permissions-you-hand-over-1-architecture.jpg)