Browsers that act for you: Perplexity Comet and ChatGPT’s browser agent

Short answer: A small firm should approve an AI browser's permitted sites, information and actions before allowing it to work inside business accounts. OpenAI's help center says ChatGPT Atlas has been retired, so for a firm whose staff used it the live question is what is installed in its place. Perplexity publishes Comet controls for assistant activity and browsing context, but the firm still needs to verify the exact plan and settings it will use. Our recommendation is to begin with public information, a separate test account where needed and a person supervising every permitted action.

Obsidian Ridge offers the assessment below. Product statements are attributed to the vendors; the approval boundaries and test plan are our recommendations for a small firm.

Key facts

• Atlas is gone: OpenAI's help center states, “ChatGPT Atlas has been retired and no longer receives updates.” There is no Atlas rollout left to approve. OpenAI: ChatGPT Atlas retirement, checked November 3, 2026.
• Where the browser agent went: OpenAI's release notes state, “We’re deprecating Atlas as we bring browser-based agentic capabilities into ChatGPT and Codex.” The same note gives August 9, 2026 as the date Atlas stops working, which has passed. OpenAI release notes, checked November 3, 2026.
• Browser-agent risk: OpenAI's December 2025 research describes “prompt injection as a long-term AI security challenge”. That historical analysis is useful context, not evidence that a current product eliminates the risk. OpenAI research, checked November 3, 2026.
• Comet site controls: Perplexity documents “Block tasks on specific websites” and explains that requested assistant tasks can transfer current-tab content and relevant history to its service. Perplexity Privacy Snapshot, checked November 3, 2026.
• Action visibility: Perplexity describes “clear buttons to stop the Assistant” and choices for one-time or automatic browsing. Treat those as features to verify during a pilot. Perplexity assistant controls, checked November 3, 2026.
• Enterprise controls: Perplexity's enterprise page advertises “Block domains, set browser approvals, and limit tasks assigned to agents”. Confirm availability and enforceability for the purchased plan. Comet Enterprise, checked November 3, 2026.

What is different about a browser that takes actions?

Our approval model separates three questions: what the assistant may read, where it may send information and what it may change. A permission to summarize a public page does not answer whether it may open a client portal, draft a message or submit a form. Write down those boundaries before choosing a broad instruction such as helping with a day's administration.

Make the review specific to a proposed task. For example, a firm could evaluate a browser assistant for comparing publicly posted conference schedules. The approved input would be public event pages; the result would be a draft comparison checked by an employee. Booking travel, entering payment information and sending invitations would remain outside that pilot. This is an invented use case, not a reported customer result.

Then list the accounts available in the test session. A pilot does not need a partner's normal browser profile full of client-system sessions. Our recommendation is to use the minimum account access required for the agreed task and inspect any connected services before beginning. Ask the administrator how the pilot can be stopped and its access removed.

For the broader review of installed agents and their reach, use AI agents on work laptops. This guide narrows that question to browser context, website permissions and delegated actions.

What if staff were using ChatGPT Atlas?

Then the decision is not whether to approve it. Atlas has stopped working: OpenAI's help center says it has been retired and no longer receives updates, and the release notes gave August 9, 2026 as the date it stops working. OpenAI: ChatGPT Atlas retirement, checked November 3, 2026.

So find what is installed in its place on each machine. OpenAI's release notes point two ways: “For deeper browser-based agentic work, try the ChatGPT desktop app”, and to the ChatGPT Chrome extension or sidebar where it is available. Whatever is there now is a new product decision and takes the same review as any other browser assistant — which account, which plan, which sites, what context, which actions. OpenAI release notes, checked November 3, 2026.

Ask about records before anybody deletes anything. OpenAI says Atlas browser data, including bookmarks, open tabs and browser history, will not transfer automatically, and tells workspace administrators to share the retirement article with members who used it. Ask counsel or the records owner about preservation obligations first, then record what was preserved, what was removed and what still needs a vendor answer. Do not treat uninstalling an application as proof that every connection or stored record went with it. OpenAI: ChatGPT Atlas retirement, checked November 3, 2026.

A replacement should receive its own review. Approval of a general chat service is not approval of every browser, extension or agent that uses that brand. The ChatGPT tool entry records what OpenAI publishes about that service plan by plan, and now carries the Atlas retirement; it is not a deployment guide for whatever took its place.

What should we verify in Comet's settings and plan?

Perplexity's Privacy Snapshot describes controls for restricting assistant tasks by site and turning the assistant off. It also says a requested task can transfer browsing context to Perplexity. Our recommendation is to map the proposed task to those controls and test the result with public or fully invented content. Perplexity Privacy Snapshot, checked November 3, 2026.

Ask the vendor and administrator to distinguish personal settings from controls the organization can enforce. The enterprise page advertises domain restrictions, browser approvals and agent-task limits, but an advertised capability is not evidence that it is enabled for the firm's accounts. Obtain the plan-specific documentation, identify the administrator and capture the actual configuration used in the pilot. Comet Enterprise, checked November 3, 2026.

Use a short evidence table rather than a general privacy score:

The table is a proposed test plan, not a claim that every plan implements every control. If a necessary restriction cannot be demonstrated, narrow the task or hold approval. Use the Comet tool entry for the dated evidence on the browser itself, and the Perplexity tool entry for the wider service, while keeping the browser-specific review separate.

Does a stop button settle the action-approval question?

No. Decide what staff may delegate before relying on their ability to interrupt it. Perplexity describes watching actions and choosing whether the assistant browses once or automatically. It also describes pauses when the assistant recognizes important tasks. That description is not a promise that every action your firm considers sensitive will always trigger the same approval. Perplexity assistant controls, checked November 3, 2026.

Our recommendation is to keep sending, submitting, purchasing and changing business records outside the initial pilot. If a later use needs one of those actions, approve it separately and define the exact review point. Test with a disposable account and invented material before considering actual business information.

Have the observer practice stopping a harmless test task, then inspect what already happened. Record the difference between interrupting the remaining work and reversing completed actions. If the firm cannot tell what occurred, that is an unresolved operational question even when the final answer looks correct.

Why does untrusted page content matter?

OpenAI's historical research describes prompt injection as malicious instructions embedded in content an agent processes, intended to redirect its behavior. A webpage or message can therefore be part of the task's information and an attempted source of instructions. This is the security issue the research discusses, not a claim that a particular Comet session has been compromised. OpenAI research, checked November 3, 2026.

Our practical response is to keep the task narrow and limit the information and actions available to it. Tell staff to stop and report unexpected destinations, requests for additional access or actions outside the approved purpose. Keep a person responsible for the result rather than treating fluent completion text as the evidence of what happened.

Review existing browser protections as a separate part of the pilot. The guide to controlling browser downloads explains the broader question of where business information can leave an application. A control tested in another browser should not be assumed to apply to a new assistant browser. Ask the administrator to demonstrate the actual path proposed for work.

What can the firm decide this week?

1. Inventory the browsers. Name the product, version, plan, work account and owner. Where Atlas was in use, record what is installed in its place and treat that as a new approval.
2. Choose one task. Start with public information or invented data. Write down permitted sites, inputs, outputs and actions in ordinary language.
3. Limit account access. Use a dedicated pilot setup with only the access needed. Keep client portals and sensitive business systems outside the initial test.
4. Verify the controls. Check domain restrictions, assistant settings and administrative authority against the exact plan. Record limitations instead of assuming an enterprise feature exists on a personal subscription.
5. Observe and stop a test. Inspect the actions, practice interruption and confirm the result. Keep externally consequential actions on hold until separately reviewed.
6. Issue the decision. Approve the bounded task or name the missing evidence. Set an owner, a review date and a trigger when the browser, plan or intended use changes.

For a law firm or financial adviser, bring proposed client-information use to counsel or the compliance officer before widening the pilot. Browser settings do not make the professional or recordkeeping decision.

Use the AI tool risk checker to organize unanswered questions and the AI policy builder to document the approved use. The AI-tool index provides dated vendor evidence. An assessment can identify agreed tools and access paths; approval still needs to identify the exact workflow the firm will operate.

Sources

Opened November 3, 2026:

• OpenAI: ChatGPT Atlas retirement: the retirement notice, what happens to Atlas browser data and the workspace-administrator guidance.
• OpenAI: ChatGPT release notes: where browser-based agentic work moved, and the date Atlas stops working.
• OpenAI: hardening Atlas against prompt injection: December 22, 2025 research and the browser-agent threat model.
• Perplexity: Privacy Snapshot: assistant settings and browsing context.
• Perplexity: Comet Assistant controls: action visibility, browsing choices and interruption.
• Perplexity: Comet Enterprise: advertised administrative capabilities, subject to plan verification.