You've Always Been the One Browsing the Internet. This Year, Something Else Quietly Started Doing It For You

Here's a story that should bother you more than it probably will: in early 2026, security researchers found a way to take over someone's password manager without that person clicking on anything suspicious at all. No dodgy link. No phishing email they fell for. All it took was an ordinary-looking calendar invite landing in their inbox. Their AI browser glanced at it while checking their schedule, and buried inside that invite were instructions, not for the person, but for the browser itself. The browser followed them. It quietly opened the password manager and started changing things, while showing the person a perfectly calm, ordinary-looking screen the whole time.

Nobody was careless. The browser just couldn't tell the difference between "what my user wants" and "what this calendar invite is telling me to do." And that mix-up is the whole story of where browsers are right now.

#The browser stopped just showing you things

For thirty years, a web browser did exactly one job: it showed you what you asked to see. You typed something, clicked something, and it displayed the result. It was a window. It never acted on its own.

That has changed, fast, and probably faster than most people outside tech have noticed. Perplexity's Comet, OpenAI's Atlas, Claude's browser extension, and a handful of others don't just show you the internet anymore. You give them a goal in plain language, "find me the three cheapest generators with free delivery in Nairobi" or "read these five articles and tell me what they agree on," and the browser goes and does it. It opens tabs, reads pages, compares things, fills in forms, and comes back with an answer. You didn't click once.

This isn't a lab demo anymore. According to security firm HUMAN's tracking of agent traffic in April 2026, Comet alone accounted for roughly 48% of all identified AI-browser activity, with Atlas at about 21% and Claude's Chrome extension at 17%. That's not a handful of hobbyists testing a toy. That's a real, sizeable share of internet traffic that is no longer generated by a human hand on a mouse.

#What it's actually being used for might surprise you

Here's the part I found genuinely interesting once I looked at the numbers properly. You'd expect people to be handing these browsers their credit cards immediately, letting them shop and check out on their behalf. They mostly aren't. The same HUMAN report found that about 70% of agent browser activity is reading articles, comparing product listings, and running searches. Only around 3% involves an actual checkout or payment. People are comfortable letting the browser look and compare. They are, for now, still keeping their hand on the wallet.

That's a sensible instinct, and it lines up with something I wrote about a few weeks ago: the moment AI starts being trusted to actually click "pay" on your behalf is a bigger leap than letting it browse, and it's coming, but people are correctly treating it as the harder trust to hand over. If you haven't read that piece, it's worth pairing with this one, because browsing and paying are really two separate permissions, even though they're starting to live in the same product.

#Here's the harsh part

The calendar invite story at the top of this post wasn't a one-off bug. Researchers at Zenity Labs found the same category of flaw across multiple AI browsers, not just one company's product: an attacker plants instructions somewhere the browser will read, on a webpage, in a document, in a calendar invite, and the browser can't reliably tell that content apart from a legitimate instruction from you. "The agent is persuaded that what the user actually asked for is what the attacker desires," is how one of the researchers put it. Perplexity patched the specific hole that was reported to them, in February 2026, and to their credit they did it fast. But the underlying weakness, a browser that reads everything on a page and can't always separate "information" from "instructions," is not something one patch fixes for good. It's a structural problem with how these tools currently work, and it will keep resurfacing in new forms.

So the honest picture is this: a genuinely useful tool, being adopted at real scale, with a real and still-unsolved trust problem sitting underneath it.

#The actual skill worth building right now

I don't think the answer is to avoid these browsers. For a small business owner, the time they save is real. Comparing supplier quotes, checking a handful of competitor prices before you set yours, pulling together research on a new market, reading through a stack of PDFs you've been putting off, all of that is exactly the kind of tedious, low-risk browsing an AI browser is good at and a busy person doesn't have time for.

The skill that matters now isn't "learn to use an AI browser" or "refuse to use one." It's learning to delegate the way you'd delegate to a new employee on their first week: give them real work, but don't hand them the keys to everything on day one. Concretely, that means a few things. Let the browser loose on tasks that are purely informational, research, comparison, reading, summarizing. Keep it away from your password manager, your email inbox, and anything involving money or sensitive documents until you've watched it work long enough to trust its judgment on the easy stuff first. Don't accept calendar invites or open attachments from people you don't recognize just because your AI assistant will "handle it," since handling it is exactly the failure mode above. And when a task does touch something sensitive, do it yourself, or at minimum, watch every step instead of walking away.

None of that requires being a technical person. It requires treating a new kind of assistant the way you'd treat any new hire: useful immediately for the easy stuff, earning trust for the sensitive stuff over time, never given a blank cheque on day one.

Try it this week on something low-stakes: have it compare prices from three suppliers, or summarize a handful of articles on a topic you've been meaning to read up on. Keep your passwords and your payment details out of it for now. That's the whole habit. It's a small one, and it's the difference between getting the real benefit of this shift and becoming the next calendar-invite story.