When Gartner published its advisory on AI browsers, the recommendation was not "adopt carefully" or "pilot with guardrails". The title said it plainly: Cybersecurity Must Block AI Browsers for Now. For a research firm that usually counsels measured adoption, that was an unusually blunt instruction.
Ten months later, the picture is more complicated. Attacks on browser agents have moved from research labs into documented incidents, while a new category of enterprise browsers built specifically for AI agents launched as recently as 29 October 2026. Employees, meanwhile, are not waiting for policy.
This guide explains what an agentic browser is, why it creates a distinct risk class, and how enterprise leaders in Hong Kong can decide whether to block, contain or enable it.
What Is an Agentic Browser?
An agentic browser is a web browser with a built-in AI agent that can act on a user's behalf: reading pages, clicking buttons, filling forms and chaining tasks across websites. Unlike a chatbot that only answers questions, it operates inside your logged-in sessions, with the same access as the employee using it.
Well-known examples include Perplexity's Comet and OpenAI's ChatGPT Atlas, and AI features are now being added to mainstream browsers too. The common thread is autonomy. A user can say "compare these three supplier quotes and update the tracker", and the agent navigates the sites itself.
That autonomy is the value and the risk at the same time. The browser is where employees reach the CRM, the HR system, the banking portal and the shared drive. An agent that can act in all of them inherits all of that access.
Why Did Gartner Tell Enterprises to Block AI Browsers?
Gartner advised blocking AI browsers because their default settings favour user experience over security, they send browsing content to cloud AI services, and they are exposed to indirect prompt injection that can trigger rogue agent actions. Its December 2025 advisory recommended using existing network and endpoint controls to block installation until the risks are manageable.
According to coverage of the advisory by CSO Online and The Register, Gartner's analysts highlighted three concerns:
--- Data exposure. AI sidebars can send active browser content, including open tabs, page data and browsing history, to cloud-based AI systems.
--- Rogue actions. Indirect prompt injection can cause the agent to take actions the user never intended.
--- Unsafe defaults. Out-of-the-box settings prioritise convenience and automation rather than enterprise controls.
Gartner also expected that even organisations approving an AI browser would need to enforce usage policies and monitor its activity. In other words, "approved" was never meant to mean "unmanaged".
How Does Prompt Injection Turn a Browser Agent Against You?
Prompt injection hides instructions inside content the agent reads, such as a web page, email or document. Because the agent cannot reliably tell data from commands, it may follow those hidden instructions, for example by exporting data or submitting a form, using the employee's own logged-in access.
This is not a theoretical concern. OpenAI acknowledged in December 2025 that prompt injection may never be fully eliminated from browser agents. Since then, the evidence has accumulated:
--- March 2026: Zenity Labs disclosed "PleaseFix", a zero-click hijacking technique with Perplexity Comet as the primary affected system, according to a Cloud Security Alliance research note.
--- June 2026: LayerX's "BioShocking" research reported compromising six AI-powered browsers and extensions, including products from OpenAI, to steal credentials.
The Cloud Security Alliance draws the key conclusion: the scope of a single compromised browser agent session is limited only by the number of authenticated applications the user has open. For a finance manager with the ERP, the bank portal and email open, that scope is wide.
Is Blocking Agentic Browsers Still the Right Answer in Late 2026?
Blocking remains the right default for unmanaged consumer AI browsers, but it is no longer the only option. Enterprise-grade browsers designed for AI agents now offer per-agent permissions, read-only modes and audit trails. The realistic choice for most organisations is containment: block what you cannot govern, and govern what you choose to allow.
The market is moving quickly. On 29 October 2026, Island, which raised US$400 million at a US$6.4 billion valuation in September, launched an Enterprise Browser for Agents. Its announcement describes controls that illustrate what "governable" now looks like:
--- Agents granted only authorised tools and pages, set per agent and per application, including whether they can write or only read
--- Read-only mode on systems of record such as ERPs, so agents can view and extract but not modify or delete
--- A credential vault that injects passwords into login forms so they never pass through the model's context window
--- Audit logs recording whether a human or an agent took each action
Major security vendors are moving in the same direction, with browser-level controls for AI activity becoming a standard feature of enterprise security platforms rather than a niche add-on. For a buyer, that means the question is shifting from "can this be governed?" to "which controls do we require, and who verifies them?"
The point is not any single vendor. It is that blanket blocking is now a choice with an opportunity cost, because governed alternatives exist. A blanket ban also tends to push usage into personal devices, where you have no visibility at all.
What Controls Should an Enterprise Require Before Allowing Browser Agents?
Before allowing browser agents, an enterprise should require five controls: scoped permissions per application, read-only access to systems of record, credential isolation from the AI model, human-versus-agent attribution in logs, and human confirmation for high-impact actions such as payments or data exports. Without all five, the safest answer is still to block.
1. Scoped permissions. The agent should reach only named applications, not everything the employee can reach. Least privilege is the single most effective limit on blast radius.
2. Read-only by default on systems of record. Allow agents to extract and summarise from finance, HR and client systems, but not to submit or delete.
3. Credential isolation. Passwords and tokens should never enter the model's context. Treat agent credentials with the same discipline as any other machine identity; our explainer on why an AI API key works like a company credit card sets out the same principle.
4. Attribution. Every action must be traceable to a human or an agent. Without this, an incident investigation cannot answer the first question a regulator will ask.
5. Human confirmation for high-impact steps. Payments, bulk exports, permission changes and external emails should require an explicit human click.
How Should a Hong Kong Enterprise Decide: Block, Contain or Enable?
A Hong Kong enterprise should decide by data sensitivity and regulatory exposure. Block agentic browsers wherever personal data or regulated client information is handled without the five controls in place. Contain them in a governed pilot where data is low-risk. Enable them broadly only after the pilot proves both controls and value.
A three-tier model works well in practice:
--- Block: unmanaged consumer AI browsers on corporate devices, and any agent use on systems holding customer personal data, client money or regulated records
--- Contain: a named pilot group using an enterprise-managed browser on low-risk work such as market research, competitor monitoring or internal knowledge lookups
--- Enable: wider rollout to specific workflows once logs, permissions and confirmation steps have operated cleanly for at least one quarter
The local regulatory context supports this caution. The Privacy Commissioner for Personal Data's 2026 compliance checks on 60 organisations recommended that every organisation developing or using AI establish an AI strategy and governance structure, and law-firm reviews of the findings highlighted the rise of agentic AI. For banks, HKMA expectations on board oversight of digital transformation add a further layer.
Consider a mid-sized insurance broker. Allowing agents to research product specifications on public websites is a low-risk containment pilot. Allowing the same agents into the policy administration system, which holds customers' health and financial data, is a different decision entirely and belongs in the "block" tier until controls are proven.
What Mistakes Do Organisations Make When Governing Browser Agents?
The most common mistakes are assuming a general AI policy covers browser agents, banning them without monitoring for shadow use, granting agents the employee's full access, and measuring adoption instead of controls. Each leaves the organisation exposed while appearing compliant on paper.
--- Relying on a generic AI policy. Most AI policies were written for chat tools that answer questions. Agents that act inside authenticated sessions need their own acceptable-use rules.
--- Banning without detecting. A ban that is not enforced through endpoint and network controls simply moves usage out of sight.
--- Inheriting full user access. If the agent can do everything the employee can, one injected instruction can do everything too.
--- Treating it as an IT-only decision. Which workflows an agent may touch is a business and risk decision. It needs the COO, the risk owner and the data protection officer, not only the IT director. Our guide to AI transformation orchestration explains how to split that ownership across the C-suite.
What Should Leaders Do in the Next 90 Days?
In the next 90 days, leaders should discover current AI browser usage, set an explicit interim policy, choose one low-risk pilot workflow with the five controls in place, and report results to the risk committee. This converts an unmanaged exposure into a governed experiment with a clear decision point.
--- Days 1 to 30: inventory AI browsers and extensions on corporate endpoints, and publish an interim policy stating what is blocked
--- Days 31 to 60: select an enterprise-managed option and a pilot group of 10 to 20 users on low-risk tasks
--- Days 61 to 90: review logs, incidents and time saved, then decide whether to extend, adjust or stop
Assign one accountable executive for the whole 90 days, ideally the COO or the head of risk, with IT and the data protection officer as named contributors. A single owner prevents the familiar pattern where security blocks, the business works around the block, and nobody reports the gap upward. Set the decision date in advance, so the pilot ends with a clear recommendation rather than drifting into permanent, unreviewed use.
Conclusion: Govern the Browser, Because That Is Where the Work Happens
Agentic browsers are not a passing feature. They move AI from answering questions to taking actions inside the systems your business runs on. That makes them one of the most valuable and most exposed tools your employees will touch.
Blocking buys time. Containment builds evidence. The leaders who use the next quarter to put controls in place will be the ones able to say yes with confidence when the business asks.
We understand the cold edges of AI and the hard parts of your work, and UD has walked with Hong Kong enterprises for twenty-eight years, making technology a partnership with warmth.
Reviewed by the UD enterprise AI and cybersecurity team.
🛡️ Ready to Strengthen Your Security?
UD is a trusted Managed Security Service Provider (MSSP)
With 20+ years of experience, delivering solutions to 50,000+ enterprises
Offering Pentest, Vulnerability Scan, SRAA, and a full suite of cybersecurity services to protect modern businesses. We'll walk you through every step, from assessing AI browser exposure to testing controls and monitoring agent activity.