AI Browsers Convenience Versus Your Privacy

OpenAI CEO Sam Altman recently described a vision for AI that proactively assists you by observing your life. This idea is the driving force behind a new generation of AI-powered browsers, including OpenAI’s ChatGPT Atlas and Perplexity’s Comet.

These new tools differ from traditional browsers in two key ways. First, a chatbot is always accessible, allowing you to ask questions about the content you're viewing, whether it's summarizing an article or explaining an image. Second, an 'agent mode' allows you to delegate entire tasks to the AI, such as editing a Google Doc or handling your Amazon shopping.

However, this advanced functionality comes with significant privacy trade-offs. Lena Cohen, a staff technologist at the Electronic Frontier Foundation, warns, “Atlas is getting access to a lot more information than other browsers, and the information that Atlas accesses can be used to train OpenAI's models.” To provide context-aware answers, these browsers send personal details from the websites you visit—like Amazon order histories or WhatsApp messages—to their servers for processing. Traditional browsers may log the URLs you visit, but they don't see the content on those pages.

Or Eshed, CEO of browser security platform LayerX, calls this trend a “gold rush into user data in the browser.” Before you dive into the world of AI browsing, here are several critical points to consider.

Understanding What Data AI Browsers Collect

When you use a chatbot through a browser sidebar, you have less control over the data being shared compared to using the chatbot’s website directly. The sidebar feature automatically includes the context of the website you are currently viewing.

Accessing ChatGPT in the Atlas sidebar attaches the site that you’re viewing for context, indicated by the bubble with the website name in the sidebar.

According to Pranav Vishnu, the product lead for Atlas, the specific data retrieved varies. For a visual page, it might be an image; for an article, it might be the text. The optional 'browser memories' feature in Atlas goes even further by storing a description of every site you visit.

While users don't know exactly what information the AI pulls, Atlas provides some controls. You can remove a specific page from the chat context or block entire websites from being accessed by ChatGPT through the browser's settings.

Users can remove a page from the chatbot’s context on a one-off basis by clicking the "X."

Or users can block Atlas from viewing the website permanently using the settings in the browser bar.

Perplexity, however, lacks these granular controls. To prevent it from accessing sensitive information, you must open a new, non-sensitive tab before using its sidebar, as it only pulls context from the active tab.

How Your Data Is Used for AI Training

Atlas has two settings related to data training. The first, “Improve the model for everyone,” is on by default and allows OpenAI to use your queries and provided information for training. Since Atlas automatically attaches the website you're on, this can include personal data from social media or other sites. OpenAI claims it scrubs personally identifiable information before training, but the specifics of this process are unclear.

Atlas allows users to opt out of their data being used for AI training.

A second setting, “Include web browsing,” is off by default. If enabled, it allows OpenAI to train its models on virtually all your browsing activity, including tabs you open and links you click. The most secure approach is to disable the “improve the model for everyone” option entirely, which OpenAI states will prevent both your chats and browsing data from being used for training.

Perplexity claims that data from its Comet browser is stored locally. You can also turn off data retention in your Perplexity account preferences.

The Permanence of Shared Data

Opting out of AI training doesn't stop your data from being sent to OpenAI's or Perplexity's servers; it only limits how they can use it. “It's important for people to understand that once your sensitive data is on another company's servers, you have very little control over what happens to it,” says Cohen. She warns that this data could be misused by hackers or requested by governments. For context, OpenAI complied with 105 U.S. government requests for user data in the first half of this year.

The Security Risks of AI Agents

The launch of AI browsers has raised alarms about 'prompt injection' attacks, where malicious actors could hijack AI agents to steal sensitive information like banking data. These attacks work because AI agents can struggle to distinguish between website content and instructions. Attackers can embed hidden, malicious commands on a webpage that are invisible to users but are read and executed by the AI.

“Users need to be cautious about activating agentic mode on unknown sites,” Eshed advises. “Not all threats are immediately visible.”

To address this, Atlas offers a logged-out mode where the agent cannot access your personal accounts, reducing the risk of a data breach. Perplexity does not have this feature, making its agent mode inherently riskier. Vishnu recommends that users start with logged-out mode and only grant access as needed for specific tasks.

The Real Reason for the AI Browser Rush

Embedding AI deeper into our digital lives is a core strategy for AI companies. Dan Hendrycks, executive director at the Center for AI Safety, notes that machine learning progresses by “scavenging for data,” and AI browsing is a potentially massive new source.

This explains the rush to market, even with products that feel unfinished. By launching early, companies can collect more data than competitors, creating a flywheel effect: more data improves the product, which attracts more users, leading to more data and, ultimately, more revenue. But as a user, you have the choice to opt out.

“ChatGPT Atlas keeps advertising itself,” Hendrycks remarks. “I feel no inclination to download.”