AI-Native Browsers: Why the Browser Wars Are Back

AI-Native Browsers: Why the Browser Wars Are Suddenly Back

The browser wars didn't restart because someone shipped a slicker interface. They restarted because a federal judge forced Google to share the data that made Chrome close to unbeatable, and because OpenAI, Perplexity, and Atlassian collectively committed close to a billion dollars to the bet that AI agents belong inside the browser itself, not just in a chat window bolted on top of it. Ten months into that bet, one of the three contenders has already shut down.

The legal opening nobody planned around

Start with the part of this story that has nothing to do with AI. On September 2, 2025, Judge Amit Mehta ruled in the Justice Department's antitrust case against Google that Chrome would not be divested. Google keeps the browser. But the ruling came with a six-year ban on exclusive distribution contracts covering Search, Chrome, Google Assistant, and the Gemini app, plus a requirement that Google share its search index and user-interaction data with what the court calls "qualified competitors." Not ad data — Google kept that. But the raw signal that makes a search engine good gets shared now, for the first time in Chrome's history.

Chrome still runs 69.65% of the browser market as of June 2026, according to StatCounter. That's not a company under siege. But the data-sharing mandate closes off the one advantage a challenger couldn't route around by building something better — Google's exclusive access to the interaction data that trains a better search product. A rival browser competing purely on search quality still loses. A rival competing on task completion, where an agent reads your tabs and does something with them rather than returning ten blue links, is playing an entirely different game, one where Chrome's moat matters less. That's the opening three companies decided to walk through at once.

The Justice Department and a majority of states weren't satisfied with the ruling, either. They cross-appealed in February 2026, pushing again for a forced Chrome sale. That fight is still live. Whatever happens to Chrome specifically, the data-sharing requirement is already in effect and already reshaping what a new entrant can build.

Where the money actually went

Atlassian agreed to buy The Browser Company — maker of Dia and the now-paused Arc browser — for $610 million in cash in September 2025. The detail that tells you how seriously the rest of the industry took this: OpenAI and Perplexity had both reportedly looked at acquiring the same startup first. Atlassian won it partly on reach. The company already serves more than 300,000 customers, including over 80% of the Fortune 500, and framed the acquisition around a specific complaint — that Chrome, Safari, and Edge were all built before SaaS tools and AI existed as daily-use categories, and none of them understand what a tab actually represents for someone doing real work.

OpenAI took a different route and built its own browser from scratch. ChatGPT Atlas launched October 21, 2025, Chromium-based, macOS-only, with a free tier and a paid Agent Mode that could act across sites on a user's behalf. Perplexity's Comet, structurally similar, went free worldwide by late 2025 and expanded across Windows, macOS, iOS, and Android — the only one of the three standalone bets that shipped everywhere at once.

The first casualty

Here's the part most coverage of this trend hasn't caught up to yet: Atlas didn't make it a year. OpenAI announced on July 9, 2026, that it was retiring the standalone browser, with the app scheduled to stop functioning on August 9, 2026 — nine and a half months after launch. The agentic features survive. OpenAI is folding them into the ChatGPT desktop app and a Chrome extension instead of maintaining a separate browser.

That's a real signal, not a footnote. A company with effectively unlimited capital and the loudest brand in AI concluded that owning a standalone browser wasn't worth the maintenance cost, and that the same agent capability works better glued onto software people already have open. Comet remains the clearest standalone survivor. Gemini's Auto Browse, built directly into Chrome with no separate download required, represents the opposite bet entirely — don't ask anyone to switch, meet them where 69% of the market already is.

Two models are emerging from this, not three. One is the dedicated AI-native browser, which only Comet is still running at real scale. The other is an agent layer added to a browser people already use, which is where Google started and where OpenAI just retreated to. A third standalone challenger trying to convince people to switch browsers again, after watching Atlas's run end in under a year, has a much harder pitch to make than it did in October 2025.

The problem nobody has actually fixed

None of this addresses the thing that should worry anyone about to hand a browser their email, banking, and shopping logins: indirect prompt injection is not solved, and the companies building these products say it might not be solvable at all.

Brave's security team disclosed a working exploit against Comet in mid-2025 — a hidden instruction embedded in an ordinary webpage could get the browser to read a user's email or reach into an active banking session, simply because Comet fed part of the page's content straight to its underlying model without separating that content from the user's actual instructions. A related exploit nicknamed CometJacking used a crafted URL parameter to achieve something similar. Atlas had its own version within days of launching: researchers at NeuralTrust found a parsing flaw in Atlas's address bar that let a malicious, URL-shaped string get treated as a trusted command rather than plain text.

By December 2025, OpenAI stopped framing this as a bug to patch and started framing it as a structural property of the category. The company's own blog post called prompt injection unlikely to ever be fully solved, comparing it to social engineering — a threat you manage, not one you eliminate. Internal red-teaming had already turned up a new class of injection attacks even after the initial hardening pass. The UK's National Cyber Security Centre reached the same conclusion independently in early December, warning that these attacks may never be totally mitigated.

The mechanism is simple to state and hard to fix. Every webpage a browser agent visits becomes part of the same context the model uses to interpret your instructions, and there's no reliable structural marker separating "this is what the user asked for" from "this is text a stranger put on a webpage." An agent capable of acting inside your logged-in sessions is, by the same design, an agent that can be redirected by whatever those sessions happen to contain.

What this actually adds up to

The browser wars are back for a reason that has almost nothing to do with chatbots getting a fresh coat of paint. A court order changed what a challenger can build against Chrome's data advantage. Three well-capitalized companies read that opening as real and moved fast — one bought its way in, one built from zero, one folded the bet into an existing product. And the fastest-moving of the three already pulled its own product off the market before the story finished being written.

That's not evidence the category is fake. It's evidence the category is still being figured out in public, with real money and real security holes attached, rather than settled the way most "AI browser roundup" coverage tends to imply.