Perplexity's Comet browser reached an estimated 18 million monthly active users by April 2026, compiled from third-party tracking by AI browser analyst VoxBooster, with OpenAI's ChatGPT Atlas following at an estimated 10 to 15 million. Neither number moves the needle against Chrome's install base: dedicated AI browsers still account for under 1% of the world's 6.12 billion internet users. That obscures what actually changed. An agentic browser does not read your page the way GPTBot or a chat interface does. It opens the rendered page in a real browser engine, often signed into the user's own accounts, and acts inside it. Citation-based visibility and agentic visibility are no longer the same problem.
What an agentic browser actually does differently
An agentic browser is software, such as ChatGPT Atlas, Perplexity Comet, Microsoft's Copilot Mode in Edge, Anthropic's Claude in Chrome, or Google's agentic features inside Chrome, that can navigate, click, and fill in forms on a live webpage on a user's behalf, rather than only summarizing text it retrieved. That is a different job from the crawlers most GEO advice targets. GPTBot, ClaudeBot, and PerplexityBot fetch raw HTML and skip anything that only appears after JavaScript runs, as detailed in our look at what AI crawlers actually render. Agentic browsers do the opposite: they run a full browser engine, execute the page's scripts, and see the page exactly as a human visitor would. Several of them, including Copilot Mode and Comet, can also carry the user's own logins and saved payment details into that session, according to Microsoft's own Edge documentation. A page a bot never fully saw can now be operated on directly, with the user's credentials attached. Real rendering plus real authentication is what makes agentic browsing a separate visibility surface rather than just a faster crawler, and it is already reshaping agentic commerce specifically.
Adoption is still small, but growing across every major vendor
Microsoft's Copilot Mode launched in Edge on October 23, 2025, and expanded to Edge for Business a month later, giving Windows and Microsoft 365 users an agent that can complete complex actions like cancelling a subscription or booking a reservation without leaving the browser. Perplexity's Comet launched July 9, 2025, and went free to all users that October. OpenAI shipped ChatGPT Atlas on October 21, 2025. Anthropic's Claude in Chrome reached general availability for paid users on August 26, 2026, letting it click links, navigate between pages, and fill out forms using a person's existing logins. Google folded its earlier Project Mariner agent directly into Chrome and Gemini in early 2026. None of these vendors report audited user numbers, and VoxBooster's compiled estimate is explicit that the low-tens-of-millions figures for Comet and Atlas are vendor-adjacent, not disclosed. What is harder to dispute is the direction: a University of Washington security study published in April 2026 tested seven separate agentic browsers, a roster that barely existed eighteen months earlier. Every major AI vendor now ships one.
The security problem nobody has closed yet
That University of Washington study, presented at the Agents in the Wild workshop in Rio de Janeiro on April 26, 2026, found that four of the seven browsers tested broke the same origin policy, the rule that stops one website from reading data loaded from another inside the same browser. Researchers built a working proof of concept attack against ChatGPT Atlas that let an attacker's page pull information out of embedded content the user never intended to share. Three more browsers, including Comet, had conditions that could enable similar attacks. Brave's security team found in July 2025 that Comet processed webpage content and user instructions through the same channel, so hidden text on a page, an invisible font, an HTML comment, even a Reddit spoiler tag, could be executed as a command. Brave demonstrated pulling a user's email and one-time password by hiding instructions on a page and letting Comet act on them inside the user's own logged-in session. Perplexity patched the flaw within 48 hours of disclosure, though Brave's follow-up testing in August found the fix incomplete. Not every vendor has left the problem where it started: Anthropic says the probes and classifiers it added ahead of Claude in Chrome's general availability cut prompt injection success to zero percent in its own internal testing, for whatever an internal test is worth. University of Washington professor David Kohlbrenner put it plainly:
Browser agents aren't ready for the public. If these agents have access to a browser that contains your credentials, your email, your bank account, whatever it is, you should not trust that these systems are ready to truly protect your information.
Nobody will say how an agent actually picks a brand
Chat based citation has at least some documented logic behind it. Our look at how Perplexity decides which sources to cite covers ranking signals like source authority and freshness. Agentic shopping adds an extra, mostly opaque step after that: once an agent decides to act, something still has to choose which listing to click, which size to select, which retailer to check out with. eMarketer's hands-on review of Comet's shopping feature found it could surf review sites, listicles, and news articles to shortlist a pair of boots, then ran into checkout errors trying to complete the purchase. The review found no way to see which sources Comet weighted more heavily or why one retailer beat another. That is a meaningfully different problem from the one covered in our look at whether product pages are ready for AI shopping agents: it is not only whether an agent's shopping tool can read your page, it is whether anything explains afterward why it picked a competitor instead.
How to spot agentic traffic in your own logs
Telling this traffic apart from a person, or from an ordinary crawler, is its own open question. Google recently introduced Google-Agent, a distinct identifier for AI agent requests, separate from Googlebot's own IP ranges and increasingly backed by cryptographic verification rather than a user-agent string alone, which anyone can fake. That matters because the log-reading habits built for GPTBot and ClaudeBot, the ones we walked through in our guide to analyzing AI crawler traffic in server logs, were never designed to catch a user-triggered agent acting as a single visitor rather than a bulk crawler pass.
What this changes for brand visibility monitoring
For a brand, the practical stakes are higher than they are with a citation-only crawler. Get a fact wrong on a page a chatbot cites, and worst case you show up attached to a hallucination, a risk we detailed in our coverage of AI brand fact liability. Get it wrong on a page an agentic browser is transacting against, a stale price, a broken add-to-cart button, an expired offer still showing, and the agent completes an action, or fails one, on your behalf without a human ever proofreading the page first. Because that session runs inside the browser itself rather than a citation with a visible click, it often never shows up as AI referral traffic in analytics either, what our glossary calls dark AI traffic, extending the gap our LLM brand visibility coverage already tracks between traditional metrics and what is actually happening. The fix looks less like new content and more like housekeeping: accurate structured data, live inventory and pricing that match what is rendered, and checkout flows that survive being driven by something other than a mouse. None of the vendors have published how their agents weigh a brand's trustworthiness for these decisions. Until they do, the honest assumption is that the page has to be correct for both a person and a machine, because increasingly, both are checking out with your form.
Frequently Asked Questions
What is an agentic browser?
An agentic browser is a browser, or browser mode, that can navigate, click, and fill out forms on real webpages on a user's behalf, rather than only summarizing text. Examples include ChatGPT Atlas, Perplexity Comet, Microsoft's Copilot Mode in Edge, and Claude in Chrome.
Do agentic browsers render JavaScript the way regular AI crawlers don't?
Yes. Unlike GPTBot, ClaudeBot, and PerplexityBot, which fetch raw HTML and skip content that only appears after scripts run, agentic browsers use a real browser engine and execute JavaScript exactly as a human visitor's browser would, because they need to interact with the live page.
Is agentic browsing the same thing as agentic commerce?
No. Agentic commerce refers specifically to AI agents completing purchases on a user's behalf. Agentic browsing is the broader capability, letting an agent navigate and act on any webpage, whether that means research, filling out a form, or shopping.
What security risks do agentic browsers create for the sites they visit?
A University of Washington study found four of seven tested agentic browsers, including ChatGPT Atlas, could be tricked into breaking the same origin policy, and Brave separately found Perplexity's Comet could be hijacked by instructions hidden in webpage content, a technique called indirect prompt injection.
How can a brand prepare for agentic browsers acting on its site?
Treat every page as if a machine, not just a person, will complete a transaction on it: keep structured data, pricing, and inventory accurate and current, and test that checkout and form flows still work when driven by automation rather than a mouse click.
Do dedicated AI browsers already have meaningful market share?
Not yet. Third-party estimates from VoxBooster put Perplexity Comet at roughly 18 million monthly active users and ChatGPT Atlas at 10 to 15 million as of April 2026, together under 1% of the world's internet users, though adoption is growing across every major AI vendor.