If you are considering allowing employees to use AI browsers such as Comet or Atlas, Gartner’s latest guidance offers a clear and cautionary message, pause and think again.
In a recent report, Gartner analysts Dennis Xu, Evgeny Mirolyubov, and John Watts warned that agentic browsers, more commonly referred to as AI browsers, introduce significant cybersecurity risks alongside their promised productivity gains. While these tools have the potential to reshape how users interact with websites and automate tasks, Gartner’s conclusion was unambiguous. CISOs should block all AI browsers for the foreseeable future to reduce risk exposure.
That recommendation may sound extreme at first glance, especially as organizations race to adopt AI-driven tools. However, a closer look at how AI browsers function reveals why security leaders are increasingly uneasy.
Why AI Browsers Are Fundamentally Different
Traditional browsers are designed to be passive. They render content, execute scripts, and wait for human input before taking action. AI browsers break that model.
An AI browser does not just display information, it interprets it. It understands user intent, maintains awareness across multiple tabs, and can act autonomously on a user’s behalf. That architectural shift dramatically expands the browser’s role and, with it, the attack surface.
Alex Lisle, CTO of Reality Defender, explained that unlike conventional browsers, AI browsers are not siloed by tab. They understand all open tabs simultaneously and analyze the data within them to create richer context. While this can make work easier, it also means the browser is continuously ingesting far more information than users may realize.
In effect, convenience is powered by constant data collection.
The Risk of Invisible Data Capture
One of the most immediate concerns raised by Gartner and industry experts is how AI browsers handle sensitive information.
MJ Kaufmann of O’Reilly Media warned that AI browser sidebars can unintentionally capture whatever is visible in an employee’s open tabs. Internal tools, credentials, financial data, or confidential documents can be sent to an external AI back end without the user fully understanding that transfer is happening.
This is not a theoretical issue. Browsers often serve as the front door to internal dashboards, healthcare systems, customer portals, and financial platforms. As Chris Anderson, CEO of ByteNova, noted, most people underestimate how much sensitive data lives in their browser at any given moment. Once that data is exposed, it is rarely something that can be easily reset or recovered.
When internal context leaks, the damage is often permanent.
Autonomous Actions Change the Threat Model
Another major shift is the move from assistance to action.
Dan Pinto, CEO of Fingerprint, highlighted that AI assistants embedded in browsers are designed to act on behalf of users. That can include clicking links, completing forms, or submitting information. If the AI misinterprets content or encounters malicious instructions embedded in a page, it may carry out actions the user never intended.
This is particularly dangerous because the AI is doing exactly what it was designed to do. Hidden instructions that a human would ignore can be interpreted as commands. The result is automation that attackers can manipulate.
In this model, mistakes no longer require human error. They can happen silently and at machine speed.
Long-Standing Security Assumptions Are Breaking
Gartner’s warning ultimately comes down to broken assumptions.
For decades, browser security has relied on the idea that users explicitly initiate actions, tabs are isolated from one another, and the browser itself does not make decisions. AI-native browsers undermine all of those principles at once.
Randolph Barr, CISO of Cequence Security, observed that AI browsers introduce system-level behaviors that traditional browsers intentionally avoided for decades. Autonomous navigation, cross-tab reasoning, and agent-driven workflows were once considered too risky to embed directly into a browser.
Those safeguards are now being dismantled faster than security controls can adapt.
Personal Devices Increase Enterprise Exposure
The risk grows even larger when AI browsers are installed on personal devices.
Barr pointed out that employees almost always experiment with new technologies at home first. Over time, those behaviors bleed into the workplace through BYOD policies, browser synchronization, or remote work setups. What starts as personal experimentation can quickly become an enterprise security issue with little visibility or control.
This pattern has repeated itself with cloud apps, messaging platforms, and consumer AI tools. AI browsers are unlikely to be any different.
AI Browsers Are Easy to Target
Attackers also benefit from the uniqueness of AI browsers.
According to Barr, AI browsers introduce distinctive fingerprints through their APIs, extensions, DOM behavior, network patterns, and agentic actions. With minimal effort, adversaries can identify users running AI browsers and selectively target them.
At scale, AI-driven detection makes this even easier. Attackers can automatically identify and exploit AI browser users across millions of sessions, focusing their efforts on environments that offer higher payoff and lower resistance.
In short, AI browsers can act as a beacon for targeted attacks.
The Black Box Back-End Problem
Gartner suggested that organizations could mitigate some risk by assessing the AI back-end services that power these browsers. In practice, experts say this is far easier said than done.
Will Tran of Spin.AI explained that most proprietary AI models operate as black boxes. Vendors typically do not allow customers to audit training data, internal logic, or prompt handling mechanisms. Even the vendors themselves may not fully understand the behavior of the models they deploy.
Akhil Verghese of Krazimo echoed that concern, noting that AI browsers are often closed off about what happens to data before it even reaches the AI provider. Terms of service can change, processing pipelines are opaque, and expecting organizations or individuals to continuously monitor those changes is not realistic.
Why Training Alone Falls Short
Even if an organization trusts an AI browser vendor, Gartner recommends educating employees that anything visible in their browser could potentially be sent to an AI back end.
Erich Kron of KnowBe4 emphasized that this education must be continuous. A single warning is not enough. Without regular reminders, employees will naturally focus on productivity and forget the risks.
However, training has limits.
Chris Hutchins of Hutchins Data Strategy Consultants argued that employees often do not perceive the data they work with as sensitive, especially when AI tools promise efficiency gains. This creates a shadow IT problem where data flows occur without IT or security teams having visibility or control.
Hard Guardrails Are Nonnegotiable
Lionel Litty of Menlo Security cautioned that even trusted AI browser deployments require strict technical controls. Organizations must limit where these browsers can go, apply strong data loss prevention controls, and actively defend against browser-specific vulnerabilities.
AI browsers can be steered into risky areas of the web, and traditional URL filtering alone is not sufficient protection.
Why Blocking Makes Sense Right Now
Gartner’s advice to block AI browsers is not a rejection of innovation. It is an acknowledgment that security models have not yet caught up with agentic browsing.
Until there is greater transparency, independent auditing, fine-grained controls, and the ability to fully disable autonomous behavior, AI browsers represent a disproportionate level of risk for enterprise environments.
They centralize sensitive context, automate actions without sufficient friction, and introduce attack vectors that most organizations are not prepared to defend.
AI browsers may eventually earn a place in the workplace. For now, Gartner’s message is clear, the safest move is to keep them out of enterprise environments until security, governance, and visibility can catch up with capability.
