What exactly Atlas is

Atlas is a full web browser — not an extension — with ChatGPT built into the sidebar and, more relevantly, an "agentic mode" that can take control of browsing to complete multi-step tasks: filling in forms, comparing prices across tabs, making a booking, or completing a purchase following the user's instructions.

The difference from Operator (the agent OpenAI showed in January 2026) is that Atlas builds it directly into the browser you use every day, instead of being a separate tool you have to go looking for.

Why OpenAI wants to control the browser

The business logic is clear: whoever controls the browser controls the entry point to the internet, with privileged access to search intent, shopping habits and behavioral data — exactly what made Chrome valuable to Google for two decades.

The parallel with Chrome is no accident: Google built its advertising dominance partly thanks to the behavioral data Chrome gives it. A browser with built-in agentic AI gives OpenAI a similar position, with the added layer that the agent can act, not just observe.

What agentic mode can do today (and what it can't)

  • It can: fill in web forms with provided data, browse multiple sites to compare information, and run simple purchase flows with user confirmation at the final step.
  • It still can't (reliably): complete complex financial transactions without supervision, solve CAPTCHAs designed specifically against bots, or handle sites with highly dynamic or poorly structured interfaces without occasional errors.

As with all current web agents, the success rate drops considerably on tasks of more than 5-6 chained steps — the same fragility pattern already documented in academic studies of AI agents in simulated business environments.

The security risks an agentic browser brings

Giving an AI agent control over a browser opens a new attack surface: prompt injection from malicious web page content, which can try to manipulate the agent into performing unauthorized actions (leaking session data, making unrequested purchases, navigating to phishing sites).

OpenAI implemented explicit user confirmations before irreversible actions (payments, sending sensitive data), but the risk surface of an agent that reads and acts on arbitrary web content is structurally larger than that of a chatbot that only replies with text.

Usage recommendation: for tasks involving sensitive data or payments, keep manual confirmation on and avoid leaving agentic mode running unsupervised in sessions with valuable saved credentials (banking, corporate email).