ChatGPT Atlas Browser: Agent Mode, Memory, and Security

A browser, not a plugin

OpenAI launched Atlas worldwide on macOS on October 21, 2025, for Free, Plus, Pro and Go users, with a beta for Business and, where a plan administrator enabled it, Enterprise and Edu accounts. Windows, iOS and Android versions were promised as coming later. A sidebar puts ChatGPT next to whatever page is open, reading its content automatically so a user can ask about it without copying text or switching tabs, and setup imports bookmarks, saved passwords and browsing history from whatever browser a person already used. [1]

The optional layer OpenAI called browser memories lets ChatGPT retain context from sites a person visits and recall it later, so a request like finding job postings looked at the previous week and summarizing industry trends draws on browsing history rather than a fresh search. OpenAI described the feature as off by default, viewable and archivable in settings, and tied to a per-site visibility toggle in the address bar; turning visibility off for a site stops ChatGPT from reading it and stops any memory from being created. [1]

Agent mode, with the guardrails OpenAI named itself

Agent mode, which lets ChatGPT click through a site and complete a task rather than just answer questions about it, launched in preview restricted to Plus, Pro and Business subscribers. OpenAI called it an early experience that may make mistakes on complex workflows, and listed the limits it built in: agent mode cannot run code in the browser, download files, install extensions, or reach other applications or the file system, and it pauses for confirmation on sensitive sites such as financial institutions. [1]

OpenAI's own post named prompt injection as a live risk: hidden instructions planted in a webpage or email that try to override the agent's intended behavior, potentially leading it to leak data from a logged-in session or take an unintended action. OpenAI pointed to red-teaming described in the ChatGPT agent system card and to a logged-out mode as a way to limit exposure, while stating plainly that its safeguards would not stop every attack as the technique spreads. [1]

Atlas interpretation: Publishing that admission alongside the launch, rather than waiting for someone else to find the hole, is the more informative fact than the feature itself: a vendor is telling users up front that giving an agent a logged-in browser session hands the same access to anyone who can plant text on a page it visits. [1]

A crowded field, and a skeptical security response

TechCrunch framed Atlas as OpenAI's attempt to challenge Chrome's hold on how people discover information online, and quoted Nick Turley, OpenAI's head of ChatGPT, saying he was inspired by how browsers have redefined what an operating system can look like. The report placed Atlas alongside Perplexity's Comet, launched three months earlier, and The Browser Company's Dia as the current crop of chatbot-first browsers, while noting that early web-browsing agents generally still struggle to reliably automate complex tasks. [2]

Simon Willison, writing the same day, said he would not trust browser agents until security researchers had given the category, in his words, a very thorough beating, and asked OpenAI for a fuller account of how Atlas resists prompt injection given that its stated defense leans on a user watching agent mode work in real time. He also found using agent mode underwhelming to watch, and noted OpenAI's suggestion that site owners add ARIA tags, the same markup used for screen readers, to make pages easier for the agent to navigate. [3]

Atlas interpretation: That the same accessibility markup built for assistive technology now doubles as an interface for AI agents says something about how these browsers actually parse a page: not visually, the way a person does, but through the same structured signals meant for someone who cannot see it. [3]