ai browsers, and what they do with your history

the ai browser went from novelty to battleground to consolidation in about eighteen months, and the fastest way to understand the category is to look at the one that already died.

openai launched chatgpt atlas in october 2025. on july 9, 2026 it announced the standalone browser was being retired, and atlas stopped working on august 9, 2026. nine months, start to finish. the features moved into the chatgpt desktop app and a chrome extension, which is a softer landing than most, but the browser people had made their default was gone.

that is the shape of this category as of september 2026. here is what the survivors actually do with your history.

what an agentic browser actually is

it is a browser with a model wired into the page, able to read and act rather than just display.

the difference from a chatbot in a sidebar is agency. an agentic browser can read what is on the page, follow links, fill forms, click through a checkout, and carry information between tabs without you doing it. that is genuinely useful and it is also why the security questions are different in kind.

the comet browser is the most complete of them for most people, and gemini in chrome has the distribution advantage that matters more than any feature.

the same origin problem

the boundary that keeps one website from reading another's data is 30 years old and agents walk around it.

the same origin policy dates to 1995 and is the reason a random tab cannot read your bank session. a university of washington study published july 3, 2026 tested 7 agentic browsers, including atlas, chrome with gemini, claude for chrome and comet, and found 4 of them let attackers bypass it.

the mechanism is not exotic. the agent reads content from one site and acts in the context of another, so instructions hidden in a page can reach across a boundary the browser was built to enforce. it is the browser equivalent of an employee who is helpful to everyone including the person impersonating it.

indirect prompt injection, which is now operational

hidden instructions in a page are no longer theoretical, and the trend is the wrong way.

indirect prompt injection means putting instructions inside content an agent will read: a webpage, a document, an email, a code comment, a forum post. the agent cannot reliably tell the difference between content it is reading and instructions it should follow, so it follows them.

the cloud security alliance's 2026 research note puts numbers to it. across roughly 2 to 3 billion crawled pages a month, the share carrying malicious injection grew 32% in relative terms between november 2025 and february 2026, with attackers favouring static sites, blogs, forums and comment sections. unit 42 documented the first confirmed real world case in december 2025.

the research literature is worse reading. benchmark work found even strong models in a react loop are vulnerable 24 to 47% of the time, and the attack surface widens with every tool an agent can call.

this is a live risk for anything that browses on your behalf, ours included. remynd's in app chat ships general purpose tools, including shell, python and http, so retrieved content reaching it is a real surface rather than a hypothetical one. we spell that out in private ai on your mac rather than leaving you to discover it.

browsing history privacy: read both sentences

collection and use are separate promises, and the notices often only make one of them clearly.

comparisons of the 2026 privacy notices keep finding the same pattern. atlas stored browser memories on openai's servers. perplexity has been open about wanting browsing data for advertising. dia states it does not collect browsing data to build ad profiles and that its model partners are contractually restricted from training on it.

so the questions worth asking of any ai browser:

1. where does the memory live, on the device or on their servers?
2. is browsing data used for advertising, now or under a stated future intent?
3. can model partners train on it, and is that contractual or aspirational?
4. what happens on shutdown, which atlas users found out with 30 days notice.
5. can you export it, in a format something else reads?

question 4 is the one people skip and it is the one with a track record.

the pattern this category keeps repeating

your ai tool is a product decision at a company that is not you.

atlas ran 9 months. before that, rewind defined screen memory on the mac, and in december 2025 meta acquired the company and shipped an update that disabled all capture on december 19, 2025, 14 days after the announcement, with 7 markets cut off immediately.

different companies, different reasons, identical outcome for the person who had built a habit on it. we set the general case out in what happens to your data when an ai app shuts down.

the browsers will consolidate further. the winner will be whoever owns distribution, which means chrome, and the trail you leave in it will be governed by whatever that company decides advertising means in 2028.

what a browser memory does not cover

even a perfect ai browser only ever sees one application.

per the anthropic economic index for may 2026, the number one work task in sampled ai conversations is searching electronic sources for information at 4.95%, with reference searching second at 3.74%. retrieval is the dominant use, and the topics needing a personal archive stay tiny: knowledge retrieval and enterprise search at 3.61%, personal ai assistant at 2.86%, conversation and meeting intelligence at 0.26%.

now count the working day a browser never sees.

the terminal. the video call. the native app. the pdf in preview. the figma file. slack in the desktop client. for most people that is the majority of the screen time where decisions actually get made, and none of it loads in a tab.

a browser memory is a good record of your browsing and a poor record of your work. those are different things and the marketing tends to blur them.

where the archive should live instead

on your machine, in a format you can export, covering every app rather than one.

that is what remynd does on a mac. it captures the focused window, runs ocr locally so what you looked at becomes searchable text, and keeps the index on your disk. since august 2026 it exposes that archive to claude code and codex over a local connector, covered in how to give an ai agent context.

the honest scope, because this post has been hard on other people's claims: capture, ocr and storage stay on your mac by default, you can exclude specific apps or sites entirely, and your history is read only everywhere in the app. sign in and the cloud agent do reach the network, and as noted above the in app chat's tools are general purpose. we would rather write that down than let you find it later. the security page carries the storage disclosures.

use an ai browser if the agentic browsing is useful to you, and many people find it is. just do not mistake its memory for yours. more on that distinction in ai memory is everywhere in 2026 and can chatgpt see my screen.

download remynd for mac and keep the record that outlives the browser war.