Agentic browsers are a new class of software that puts an AI agent behind the corporate login, letting it act on the web using an employee’s sessions and credentials. Perplexity’s Comet and The Browser Company’s Dia are the two products enterprise security teams are being asked about most often right now.
This review looks at both. It covers what each product does today, the enterprise controls available to IT, and the public security research shaping how risk leaders think about the category.
It then walks through how to bring agentic browsing under AI risk management when adoption moves faster than policy.
Key takeaways
- Govern agentic browsers as high-access enterprise software. Comet can act across authenticated services, while Dia currently creates a larger unmanaged-installation and shadow-AI challenge.
- Prompt injection is a category-wide weakness, not an isolated defect. Research shows that concealed text, images, and other untrusted content can manipulate browser agents through a user’s existing permissions.
- Use restricted deployment as the near-term default, but don’t rely on blocking alone. Validate vendor controls, limit access to sensitive systems, and prepare for employees to install consumer tools outside approved channels.
- Combine discovery with intent-aware enforcement and runtime protection. Effective governance requires least privilege, approval for consequential actions, inspection of routed interactions, and defenses against malicious prompts and data leakage.
What is the Comet agentic browser?
An agentic browser embeds an AI agent that executes multi-step tasks and goes beyond answering questions. It can fill forms, manage email subscriptions, book travel, and make purchases.
Unlike a browser with an AI sidebar, an agentic browser can take action using the user’s own sessions and credentials. A traditional browser renders malicious content, while an agentic browser can act on it.
Comet is Perplexity’s entry in the category. It launched for Max subscribers in July 2025 and is now free to consumers on Mac, Windows, iOS, and Android. Its assistant can find flights, schedule meetings, fill forms, and handle user email. Perplexity has since layered on autonomous background task handling.
Before approval, the Comet agentic browser must fit your organization’s existing security and browser-management requirements. You should verify its attestations, model-training terms, MDM support, browser policies, and security integrations directly with Perplexity. That review establishes which controls your security team can configure and monitor.
Where Dia stands on enterprise readiness
Today, Dia is primarily an enterprise governance and Shadow AI challenge. Because it is typically introduced outside formal IT procurement, security teams often need visibility into unmanaged deployments before they can apply appropriate governance controls. Atlassian acquired The Browser Company in 2025. For now, security teams have limited ability to govern Dia installs centrally, so the practical enterprise issue is unmanaged software on employee machines.
You can review Comet’s available configuration options before deployment. Dia often arrives as unmanaged installs on employee machines, which security teams can’t govern centrally. Those installs are the case that network-level governance has to cover.
What security research shows about agentic browser exploits
The disclosures from August 2025 through June 2026 point to two findings for risk leaders. First, the attacks reflect structural weaknesses across the category, so individual bug fixes leave the broader attack paths in place. Second, the packet-centric, keyword-based controls many organizations rely on provide limited visibility into them.
The two sections below unpack each finding. The first looks at how prompt injection turns ordinary web content into instructions the agent will follow. The second explains why the network and endpoint controls already in place often miss what the agent does inside an authenticated session.
Prompt injection turns web content into commands
Prompt injection can turn page content, images, invitations, and connected interfaces into agent instructions. The disclosed attack paths include:
- Hidden page content. In August 2025, Brave researchers embedded hidden instructions in a Reddit post’s spoiler tag. After a Comet user clicked “Summarize the current webpage,” the agent registered for a third-party site and retrieved the Gmail confirmation token. It posted the email address and token as a Reddit comment without further interaction, and Brave found Perplexity’s defense-in-depth mitigation incomplete.
- Images. In October 2025, Brave showed that instructions camouflaged inside screenshot images could steer Comet. It concluded that indirect prompt injection is “a systemic challenge facing the entire category of AI-powered browsers.”
Together, these disclosures show that agentic browser instructions can arrive through multiple forms of web content. Trail of Bits, commissioned by Perplexity to audit Comet, demonstrated four Gmail extraction techniques.
The team identified the root cause of vulnerabilities: “LLMs cannot reliably distinguish between data and instructions.” OWASP ranks prompt injection as LLM01, the top risk to LLM applications. It notes that fool-proof prevention methods may not exist.
Why legacy controls miss the agent inside the session
An AI browser agent operates with full user-level privileges across authenticated sessions. It inherits the employee’s access to SaaS apps, email, code repositories, and internal tools. Legacy packet-centric and keyword-based controls were designed to monitor network traffic and data movement, including access events. The meaningful risk in agentic browsing lives inside the page, in an encrypted conversation between the agent and its model.
Gartner’s guidance reflects that gap. A November 2025 research note recommends that organizations block all AI browsers for the foreseeable future. Gartner cites undiscovered risks in the nascent technology.
Blocking is a defensible interim posture, but adoption pressure is compounding. According to an agent adoption forecast, only 17% of organizations have deployed AI agents, yet more than 60% expect to within two years. Restriction buys time, but adoption will demand stronger visibility and controls.
Your Employees Are Already Using AI. Are You Governing It?
WitnessAI gives you full visibility into employee AI usage, classifies intent behind every interaction, and enforces smart policies, without slowing anyone down.
Learn About WitnessAI For EmployeesHow to bring agentic browsers under AI risk management
Blocking covers only sanctioned software, so the durable posture for Comet and its peers is AI risk management. The BYO AI finding shows 78% of AI users bring their own tools to work.
An agentic browser installs like a consumer app, so Shadow AI use tends to continue regardless of policy. The practical response is to discover agentic activity wherever it runs, govern it by intent, and apply runtime defenses to routed interactions. Your team also needs inspectable evidence of that work.
OWASP agent guidance emphasizes least privilege and treating external web content as untrusted input. It also calls for human approval before consequential actions. Five Eyes guidance asks for a named human owner for every agent. To apply those controls, your team needs visibility inside the browser session.
If you’re already fielding requests to sanction Comet, this is the trade-off you’re weighing now. Agentic browsers need a unified view because each one is both an employee tool and an autonomous actor operating under the employee’s identity. The three practices below outline what that view has to cover.
1. Discover agentic sessions at the network level
Network-level visibility can identify routed agentic-browser activity that may not appear in software inventories or extension audits. Because Comet is Chromium-based, agentic sessions can blend into normal HTTPS traffic. As a result, endpoint inventory limits can create visibility gaps.
In IBM’s 2025 analysis, breaches with high levels of Shadow AI averaged USD 670,000 more than those with little or none. Effective network-level discovery covers three views into routed agentic activity:
- Application discovery. Identify AI applications, agents, and MCP server connections in network traffic without deploying endpoint software. The catalog should extend to native apps such as Windows Copilot and Microsoft 365.
- Agentic-session detection. Analyze tool advertisements in traffic payloads so security teams can see when a browser has started acting instead of answering.
- MCP visibility. Identify MCP server connections and exposed external tools in routed network traffic. This helps teams understand which tools an agent reached during a session.
Together, these views give security teams a picture of browser and agent activity they can monitor and control at the network layer.
2. Govern agentic activity by intent
Traditional keyword- and regex-based controls are fundamentally context-blind. Because they cannot understand user intent or conversational context, they frequently generate false positives while missing nuanced AI interactions. Intent-based classification looks at the conversational context and purpose behind a routed interaction instead of matching strings.
Modern AI governance platforms may apply actions such as allow, warn, or block. More advanced platforms can also intelligently route prompts to approved AI models based on enterprise policy. Real-time data tokenization can also protect sensitive data before a prompt reaches a third-party model, so work continues while sensitive values stay under enterprise control.
3. Defend at runtime and keep the evidence
Because prompt injection remains a persistent architectural challenge for LLM-based systems, organizations increasingly rely on runtime AI guardrails as an important enforcement layer. They complement existing network security controls by inspecting conversational context. Bidirectional runtime defense should scan prompts before models and agents process them, then filter responses before users see them.
For routed AI traffic, effective guardrails detect and block prompt injection and AI jailbreak attacks. Captured interactions should generate granular audit trails that connect agent actions to a human identity.
That structure supports regulatory evidence and human oversight, and it turns “we have a policy” into “we can prove the policy was enforced.”
Are Your AI Applications Secure at Runtime?
WitnessAI provides bidirectional defense for your models, apps, and agents, blocking prompt injections and filtering harmful outputs before they reach users or trigger unintended actions.
Learn About WitnessAI For ApplicationsClosing the governance gap before agentic browsers scale
The Comet agentic browser and Dia present different enterprise deployment questions. Neither changes what the disclosure record established. An agent that reads the web can be steered by the web, and many enterprise controls weren’t designed to see it happen.
Organizations adopting agentic browsers at scale will increasingly need demonstrable governance, visibility, and auditability to satisfy security, compliance, and operational requirements. You need evidence that your AI controls govern system actions and are enforced in practice.
WitnessAI gives security and AI teams a shared framework for monitoring and governing agentic browser activity. Intent-based AI policies govern routed interactions, while runtime guardrails inspect prompts and responses at scale.
Schedule a demo to see how the platform documents routed sessions and retains attributable audit trails before adoption scales.