A paradigm shift is occurring in how we interact with the web, driven by the emergence of AI-powered browsers. Platforms like Perplexity Comet, ChatGPT Atlas, and the new Arc-developed Dia browser are moving beyond traditional page rendering. They can conduct deep research, manage complex multi-step workflows, and even navigate through e-commerce checkout funnels autonomously. However, this level of automation introduces unprecedented security vulnerabilities that most users are unprepared for. If you plan to incorporate AI browsers into your daily workflow, understanding these vectors and configuring your browser settings is critical to protecting your identity and sensitive credentials.
The Architecture of Vulnerability in AI Browsers
Traditional web browsers act strictly on user request. When you click a hyperlink or enter an address, the browser displays the target page, leaving actions and interactions entirely to you. AI browsers like Atlas or Comet, however, parse the document structure, summarize content, and interact with web elements in agent mode. While highly convenient, this active posture means that malicious third parties can compromise your accounts and steal data simply by manipulating how the browser interprets a web page.
The primary threat vector is prompt injection. This occurs when attackers embed malicious instructions within a website's HTML source code or a browser extension. Official OpenAI documentation explicitly warns against utilizing ChatGPT Atlas with sensitive corporate data due to prompt injection risks. This type of attack is particularly dangerous because it requires zero user action. Simply navigating to an infected web page is enough; the browser reads the invisible directives hidden in the code and executes them without prompt verification or user consent.
Real-World Exploits: CometJacking and Atlas Flaws
Security researchers have demonstrated how easily these systems can be exploited. In a process termed CometJacking, researchers manipulated Perplexity Comet by prompting it to summarize a Reddit thread that contained hidden instructions. The browser went into the user's active inbox, grabbed a one-time password (OTP), and forwarded it to an external server without triggering any visible warnings.
Similarly, ChatGPT Atlas is susceptible to input manipulation. Researcher Johann Rehberger successfully changed the browser UI from light to dark mode by directing it to read a Word document embedded with hidden layout commands. Furthermore, security firm LayerX notes that Atlas is vulnerable to cross-site request forgery (CSRF), which allows a rogue web page to send commands directly to your browser session. Since AI browsers lack the robust, established blocklists that traditional browsers use to screen phishing sites, LayerX estimates that Atlas users are 90% more vulnerable to credential-harvesting scams than Chrome or Edge users. Even retail giants are reacting to these risks; Amazon successfully secured a court injunction blocking Comet from automating checkouts on its domain, citing concerns over bypassed financial security measures.
Step 1: Terminate Automatic Model Training
By default, most AI browsers send your browsing habits and history to their developers to train subsequent generations of their machine learning models. This means your personal data is continuously harvested unless you explicitly opt out. Fortunately, major platforms allow you to disable this feature, particularly on paid tiers. This should be your first configuration step.
- ChatGPT Atlas: Open Settings, click on Data Controls, and disable the toggle for Improve model for everyone. You can also individually opt out of sharing chat history and audio files for training purposes in this menu.
- Perplexity Comet: Navigate to the New Tab Page, select Account, and open Preferences. From there, switch off the toggle for AI data retention.
- Dia: Access your browser's primary Settings, navigate to Privacy, and turn off the setting labeled Share content data to improve Dia.
Step 2: Restrict Access to Logged-In Web Sessions
Because AI browsers can read active cookies, they can execute commands within your logged-in accounts, such as drafting emails, downloading sensitive documents, or sending unauthorized messages. You must limit the agent's ability to act on your pre-existing login states.
- ChatGPT Atlas: When launching a new session, select Agent mode from the + menu. Right next to this menu, use the dropdown to switch from Logged in to Logged out. This restricts the agent from using your active session cookies, forcing it to ask you for manual credentials when access to an account is required.
- Perplexity Comet: Comet lacks a direct global switch to disable session cookie access. While it cannot access passwords saved in your operating system's vault, it can still use active browser sessions to harvest data. To mitigate this risk, always use Incognito mode when logging into any web services through Comet so your sessions expire immediately upon closing the app.
- Dia: Dia is similarly vulnerable to CSRF and prompt hijacking across active sessions. It does not offer a dedicated logged-out state, meaning the agent reads active sessions by default. Keep your logins limited to incognito sessions, or clear your local cookies regularly by navigating to dia://settings/, choosing Privacy and security, and selecting Delete browsing data.
Step 3: Defeat Memory Poisoning
While standard prompt injections run once, memory poisoning is a persistent attack. In this scenario, hackers inject malicious commands directly into your AI's account-specific memory. This malicious payload then runs during every subsequent session across all your synced devices. For instance, a poisoned memory could quietly forward your daily emails to a third party indefinitely. This cross-device threat is heightened on multi-platform browsers like Comet and Dia.
- ChatGPT Atlas: Navigate to Settings > Personalization and switch off Reference browser memories. While Atlas has native filters to block the recording of highly sensitive items like social security numbers, credit cards, and government IDs, disabling browser memory entirely is the safest approach. If you prefer to keep the feature active, routinely audit what has been saved by going to Settings > Personalization > View browser memories to delete suspicious items.
- Perplexity Comet: Flush your history and cache by visiting comet://settings/ > Privacy and security > Delete browsing data. To manage saved profile memory, go to New Tab Page > Account > Preferences > Memory. Turn off the toggles for Use search history and Notes, and use Manage memories to delete stored attributes.
- Dia: Click the Personalization setting on a new tab page. Disable Personalize new chats to prevent the browser from drawing on past conversation threads. To wipe out existing profile memories, navigate to Settings > Memory and click Reset Memory or Disable Memory.
Step 4: Block AI Agents on Sensitive Domains
To fully protect high-value assets like bank accounts, investments, and health portals, you should block AI agents from viewing or acting on these specific domains. While Atlas has built-in limits against executing local code, other browsers are more permissive, making domain-level restriction essential.
- ChatGPT Atlas: Go to Settings > Personalization and select ChatGPT page visibility. Here, you can compile a blocklist of URLs. The agent will be unable to scan or interact with these pages, though you will still be able to navigate them manually.
- Perplexity Comet: Open Settings > Privacy and security. Under the Comet Assistant settings, use the option Block personal search for these websites to prevent the agent from accessing financial or healthcare domains.
- Dia: Configure domain settings under dia://settings/ > Privacy and security > Site settings. Keep in mind that this controls individual site permissions but does not completely hide active page content from the agent; avoiding standard logins on these pages outside of incognito mode remains your best line of defense.
Essential Security Habits for the AI Browser Era
Technical settings must be paired with smart browsing habits to ensure complete protection. Implement these practices to minimize your exposure
- Use a traditional, secure browser like Google Chrome or Mozilla Firefox for your primary web traffic. Dedicate AI browsers to a separate user profile with no active web logins, using them only for isolated research tasks.
- Never download AI browsers, utilities, or browser extensions from untrusted third-party hubs. Only obtain installation packages from official development portals to avoid malware.
- Avoid using AI browsers on platforms that host user-generated content, such as Reddit, which are primary targets for prompt injection attacks. If you must use them on these sites, restrict agent permissions beforehand.
- Be cautious when copying and pasting long passages of text or complex URLs. Attackers frequently conceal prompt injection strings in lengthy URLs to target features like the Atlas Omnibox.
- When executing multi-step agent actions, monitor the browser's progress step-by-step. Use the manual pause or stop commands immediately if the browser initiates unexpected navigations or requests.
- Implement two-factor authentication (2FA) across all your digital services. Even if an AI agent is manipulated into attempting an unauthorized login or transaction, the secondary authentication step will keep your account secure.
