For Windows users, the important questions are therefore less about the “AI browser” label and more about permissions: Which accounts can the agent use? What information leaves a page? When must you intervene? Microsoft and Google document different answers, making implementation details more useful than sweeping promises about autonomous browsing.
What makes a browser agentic?
The dividing line is action. An assistant that summarizes an article helps you understand it. An agent that navigates to another site, selects options and fills a form is doing work on your behalf. PPC Land’s overview places standalone products such as Comet, Dia and Opera Neon alongside agents integrated into established browsers. Those products belong to a broad category, not a single technical design.
Three distinctions help cut through the terminology:
- AI browser: A broad description that can include summarization, writing assistance or conversational search without autonomous actions.
- Agentic browser: A browser or browser-integrated assistant capable of interacting with websites to complete a request.
- Cloud browser agent: An agent operating a remote browser rather than necessarily using the browser profile on your own computer.
The last distinction matters. “It browses for me” does not establish where execution happens, which session is available or how credentials are handled. Microsoft says Browse with Copilot performs actions locally in Edge, while also documenting screenshots and conversation records. Local clicking should not be mistaken for a promise that the entire workflow is offline or leaves no retained data.
How the action loop works
At a conceptual level, an agent observes a page, chooses an action, executes it and checks the resulting state. It repeats that process until it finishes, encounters a restriction or needs help. PPC Land describes implementations using screenshots, page markup and accessibility information; those approaches should not be assumed to apply identically to every product.
Google’s security documentation provides a concrete example. Its planning model uses shared page content to propose actions, while a separate component checks whether those actions fit the user’s request. Microsoft documents a more user-facing view: Copilot selects, scrolls and types, potentially opening another tab in the same window, while the user watches and can interrupt.
This explains both the attraction and the risk. The agent can bridge several steps that previously required your attention. But every page it reads also becomes another opportunity for irrelevant or malicious material to influence what it does next. That is why observing an agent’s work remains part of the job, rather than an optional courtesy.
The timeline needs more than product names
PPC Land traces the category through research projects, including World of Bits and WebGPT, followed by Google’s Project Mariner and the commercial browser wave of 2025. Its broader point is useful: agentic browsing developed through research prototypes, dedicated browsers and extensions before becoming a feature inside familiar browsers.
Several dates clarify what users should expect:
- July 28, 2025: Microsoft introduced experimental Copilot Mode in Edge. Its announcement separated then-available assistance, including multi-tab context and voice navigation, from more advanced actions presented as forthcoming.
- January 28, 2026: Google announced Chrome auto browse for Google AI Pro and Ultra subscribers in the United States.
- May 13, 2026: Microsoft announced the retirement of Copilot Mode and identified Browse with Copilot as the successor name for the previously limited-preview Copilot Actions experience.
Google’s own January announcement resolves the conflicting launch dates in PPC Land’s overview: January 28, 2026 is a documented introduction date, rather than July being the feature’s first appearance. The launch covered Chrome on Windows, macOS and Chromebook Plus. That historical launch scope is not a promise of identical availability across every device or account today.
Atlas also needs a precise distinction between announcement and shutdown. OpenAI’s transition documentation identifies July 9 as the planned announcement date and August 9, 2026 as the scheduled stop-working date. It describes moving browser-based capabilities into ChatGPT and Codex, rather than continuing Atlas as a standalone browser.
The lesson is practical: browser names and subscription labels can change faster than deployment documentation. Evaluate the currently documented capability, not a launch-day screenshot.
What Edge users actually get
Copilot Mode is no longer the correct name for Edge’s current action-taking feature. Microsoft’s May 13 announcement retired that mode as more Copilot experiences became built into Edge. Browse with Copilot is the relevant feature for direct browser actions; ordinary Copilot assistance, tab comparisons and voice features should not all be treated as equivalent agent capabilities.
Microsoft’s support documentation describes Browse with Copilot as rolling out to Microsoft 365 Premium subscribers in the United States, with additional markets to follow. The announcement specifies Edge desktop and usage limits. Neither document provides a minimum numbered Edge build for this feature or guarantees immediate access to every eligible subscriber.
Its access boundaries are particularly important:
| Resource | Microsoft’s documented behavior |
|---|---|
| Cookies | Available to Copilot, potentially preserving existing website sign-ins |
| Open tabs | Accessible within the current browser window for tasks |
| Saved passwords | Not accessible while Copilot browses |
| Autofill and wallet data | Not accessible while Copilot browses |
| Page screenshots | Captured from tabs where Copilot is working |
These distinctions contradict the loose assumption that an agent automatically inherits everything stored in a browser profile.
However, protecting the password store does not remove the significance of an authenticated session. If cookies already keep you signed in to a permitted website, Microsoft says Copilot can be signed in there too. In practical terms, the agent may not need to know the password to interact with the account.
How to try Browse with Copilot cautiously
Microsoft documents a short activation path. The more important preparation is choosing a task with limited consequences.
- Check eligibility. The documented consumer rollout is for US Microsoft 365 Premium subscribers on Edge desktop. A missing option is not, by itself, proof of a broken Windows installation.
- Limit existing session access. Microsoft suggests using a brand-new browser profile or deleting cookies if you do not want existing website sign-ins available to the agent.
- Choose a familiar, low-risk task. Start with a trusted site and avoid financial activity, personal identifiers, medical records and confidential material.
- Select Browse with Copilot in the Copilot text box.
- Give a clear request. Microsoft suggests opening with “On my current page…” or “In my browser…” when the task concerns an existing page.
- Watch the working tab. A cursor icon identifies where Copilot is acting. You can interrupt or take control.
- Verify the result on the website itself. Treat that final check as part of your workflow, particularly if anything was changed.
For an initial test, consider asking it to locate information on a public page rather than submit anything. A suitable prompt might be: “On my current page, find the returns policy and show me the deadline. Do not submit forms.” This is an illustrative request, not a tested guarantee.
Success should mean the requested information or page is visible and agrees with the site—not merely that the assistant reports completion.
If the feature stops, asks for intervention or refuses a site, that may reflect its safeguards rather than a malfunction. Microsoft says some websites are intentionally blocked and the feature does not work everywhere. Its documentation does not provide a registry workaround or a universal compatibility switch; inventing one would turn troubleshooting into wishful thinking.
Screenshots make privacy a separate question
Microsoft says Browse with Copilot captures screenshots of pages it uses, limited to the tabs where it is working. These images are saved with the conversation, are not used for training and are retained for up to 30 days unless the associated conversation is deleted. Prompts, responses and a record of the work also appear in conversation history.
Information entered directly into a webpage is not saved by Copilot as that direct input, according to Microsoft, although Edge may save it. Microsoft also says stopping the task stops screenshot capture and transmission until the task resumes. When personal or payment details are needed, the user can take control and enter them.
The practical conclusion is narrower than “your data stays local”: review session access and retained conversation material separately. For sensitive work, Microsoft’s recommendation is avoidance, not confidence that a confirmation dialog will make the workflow appropriate.
Prompt injection is the central security problem
Prompt injection occurs when content the agent should read as information is instead treated as an instruction. Google identifies malicious pages, embedded third-party content and user-generated material as possible entry points. Microsoft gives a similar example: hidden instructions on a recipe page could try to redirect Copilot toward collecting sensitive information elsewhere.
Brave’s August 2025 research demonstrated the danger in Comet using instructions concealed in a Reddit comment. Its proof of concept induced the assistant to obtain an email address and a one-time login code, then disclose them through a reply. This was a specific historical demonstration—not evidence that every current browser remains vulnerable to the identical attack. Brave is also a competing browser developer, a relevant context for its assessment.
Google’s documented defenses include a separate User Alignment Critic, which examines proposed-action metadata without receiving raw untrusted webpage content, and origin restrictions that constrain relevant sites. Microsoft documents site-level controls, blocklists, consent and supervision requirements. Neither approach justifies assuming that approval prompts eliminate the underlying problem.
For users, the important distinction is between permission and judgment. You may authorize a task accurately while the agent subsequently misinterprets a page. Clear instructions help define intent; they do not make hostile content harmless.
Why websites and developers care
The consequences extend beyond the person delegating a task. PPC Land describes publishers worried about visits without corresponding advertising attention, retailers concerned about agents bypassing sponsored listings, and websites struggling to distinguish delegated customer activity from unwanted automation. It also reports disputes involving Amazon and Perplexity and restrictions on agent-based purchases. Those conflicts should not be simplified into a universal right—or universal prohibition—for agents to access accounts.
Traffic measurements require similar restraint. PPC Land cites HUMAN Security and DataDome figures drawn from different observed populations and periods. Those samples are useful indicators of activity, not interchangeable measurements of worldwide browser market share. A request count does not establish how many people successfully completed purchases.
Developers have another route besides making an agent interpret visual controls. Google announced an early preview of WebMCP on February 10, 2026, describing structured tools through which sites can expose actions. Its proposed declarative API covers actions expressed through HTML forms, alongside an imperative approach for more complex interactions.
The potential benefit is clearer interaction between sites and agents. That is not the same as solving authorization or consent: making an action easier to invoke does not establish whether a particular agent should invoke it.
The enterprise takeaway: evaluate delegated authority
For IT teams, the useful assessment is not simply whether an application contains AI. It is whether that application can read business information, act through authenticated sessions and retain representations of what it sees. Microsoft’s documented cookie access, screenshots and explicit warning against confidential workflows make those concrete evaluation points.
A cautious pilot should therefore establish:
- Which accounts and sites the agent may access.
- Which tasks remain manual.
- Who watches and interrupts execution.
- How outputs are verified.
- How conversation records and screenshots are handled.
- What happens when a vendor renames or retires the feature.
These are operational recommendations derived from the documented access and retention behavior, not claims of a universal Microsoft enterprise policy.
Agentic browsing offers a meaningful convenience: fewer repetitive interactions between intent and result. But the sensible starting point remains limited scope, limited session access and visible supervision. Let the browser help with the clicking; keep responsibility for the outcome firmly on your side of the screen.