FEATUREDComputing Life · Share (鸭哥 research reports)· rssZH00:00 · 09·05
→Where the agent's browser lives: the war over keeping credentials on-device
From May to August 2026, four standalone AI browsers shut down, and agent browsing retreated into existing surfaces like Chrome, Edge, and ChatGPT. The real question became: where does the page render, and whose trust boundary holds the credentials. Nine vendors line up on a spectrum—Edge, Chrome auto browse, and Perplexity Comet keep both browser and credentials local; Cowork runs tasks in the cloud but renders the browser in the local desktop app; ChatGPT Work, Devin, Manus, and Grok Bot move the browser and logins to the cloud, with Grok Bot letting all bots on one account share a single cloud computer's session. But University of Washington research punctures the illusion: even when credentials stay local, the agent reads rendered pixels, so the same-origin policy doesn't constrain it—a cross-origin iframe showing a logged-in bank page can still be exfiltrated via prompt injection. No one is truly safe yet.
#Google Project Mariner#OpenAI Atlas#Microsoft Edge Copilot Mode
why featured
Featured · importance 78 · hook + knowledge + resonance
editor take
Four standalone AI browsers shut down in a year; the real split is whether the agent's browser runs locally or in the cloud with your credentials.
sharp
This piece is worth opening because it lines up nine vendors on a single axis: how far your login credentials travel from your machine. Edge, Chrome auto browse, and Perplexity Comet keep both the browser and credentials local. Cowork runs tasks in the cloud but renders the browser in your desktop app—a hybrid that requires the app to stay online. ChatGPT Work, Devin, Manus, and Grok Bot move everything to the cloud, with Grok Bot going furthest: all bots on one account share a single cloud computer's session, and the FAQ explicitly says not to treat different bots as a security boundary.
The lineup itself is useful, but the University of Washington research cited later is what should make you pause. Even when credentials stay local, the agent reads rendered pixels, so the same-origin policy doesn't constrain it. A cross-origin iframe showing a logged-in bank page can still be exfiltrated via prompt injection. No vendor has truly solved this yet—local-only just looks safer.
HKR breakdown
hook ✓knowledge ✓resonance ✓