Brave’s AI Browsing Agent Starts Without Your Logins

Brave opened Leo’s AI browsing to every desktop release channel on May 5, 2026, still behind a flag and still in a blank profile.

The agent cannot see the cookies, logins, or caches in your normal windows. That is the product, and it is the confession: after a year of breaking rival AI browsers, Brave shipped one that starts logged out.

Brave Put the Agent in an Empty Profile

The company first put the feature in Brave Nightly on December 10, 2025, and said agentic browsing is inherently dangerous. A later note on May 5, 2026, moved the same test into the regular desktop builds. It is still off by default. Testers still have to flip a flag, then press a button inside Leo, the in-browser assistant, before anything runs.

Brave’s own product page still described that setup on September 4, 2026: opt-in only, an extra flag, an isolated browsing profile for the agent, and a demand for explicit consent before a planned action completes. Help pages list the test on desktop Windows, macOS, and Linux. No Leo Premium plan is required. Phone builds were still described as later work.

The company posted the Nightly launch as a thread that walked through isolation, a second checker model, and the extra bounty in the same breath as the demo.

Today we're releasing AI browsing in Brave Nightly, our early access build.

AI browsing enables Brave's built-in AI assistant Leo to perform tasks on behalf of the user.

This feature is transformational, but it’s also risky. Here's how we're protecting users… pic.twitter.com/R1LmxfWmqV

— Brave (@brave) December 10, 2025

Brendan Eich, Brave’s CEO, later summed up the stack as an isolated profile, a second model that is blind to web contents for alignment checking, and a stronger model meant to resist indirect prompt injection. The pitch on brave.com/ai still lists shopping, price comparisons, research, recipes dropped into a cart, and draft emails. Those jobs usually need a logged-in site. The profile the agent gets does not inherit yours.

The Same Team That Broke Comet, Fellou, and Neon

The launch post pointed back at holes Brave had found and disclosed in other agents. Artem Chaikin, a senior mobile security engineer, and Shivan Kaul Sahib, vice president of privacy and security, ran that series. Sahib has said putting a model in control of browsing is fundamentally dangerous, and a new line for browser security.

The first public write-up, on August 20, 2025, showed indirect prompt injection against Comet. Asking Perplexity’s agent to summarize a page fed part of that page straight into the model, with no split between the user’s words and the site’s. Hidden instructions could then drive cross-site actions in the user’s own session. Brave found the bug on July 25, 2025. Perplexity acknowledged it two days later. A public note on August 20 said later tests still showed the same class of attack was not fully gone.

THE DISCLOSURE RUN

1. July 25, 2025: Brave finds the Comet summarize-page injection and reports it to Perplexity.
2. August 20, 2025: Comet details go public. The same day, Brave reports a navigation injection in Fellou.
3. October 14, 2025: Hidden-HTML injection in Opera Neon is filed through Bugcrowd.
4. October 21, 2025: Brave publishes screenshot and OCR injections in Comet, plus the Fellou case. Opera confirms a Neon fix. OpenAI’s Atlas browser also ships that day.
5. October 31, 2025: Brave publishes the Neon write-up after Opera’s October 23 note.
6. November 26, 2025: Brave’s HackerOne policy adds an LLM and AI Agent Security section.
7. December 10, 2025: AI browsing opens in Brave Nightly behind a flag.
8. May 5, 2026: The same test moves into all desktop release channels.

The October 21 Comet follow-up hid commands as faint light-blue text on yellow, unread by a person and read by OCR when the agent was asked about a screenshot. Fellou was worse in Brave’s demo: sending the agent to a page was enough for it to open Gmail and leak a recent subject line. On Neon, hidden markup led the assistant to the user’s Opera account page and out to a third-party site with the email address. Opera first closed the ticket as Not Applicable on October 17, then said that was an accident, asked Brave to wait, and had a fix in on October 21.

Simon Willison, writing after the first Comet paper, said Brave was building a similar feature that looked doomed to similar problems. The June 8, 2026 Brave note on indirect prompt injection did not claim the class had been solved. It said hidden instructions in pages and documents can still hijack agents mid-task, in the cloud and on the device.

What Isolated Storage Blocks

Brave’s answer to those demos is a new profile, created when you turn the agent on. Cookies, logged-in state, caches, and other site data do not cross from your regular windows. If the model is talked into a bad click, it does not inherit the bank tab you already opened this morning.

That is also the limit of the demo. Comet keeps cookies and signed-in sessions on the device and can use those sessions when it acts. Atlas ships an Agent Mode that University of Washington testers treated as a full browser-use agent. Brave’s agent starts with none of that. You can still sign it into a shop or a mailbox inside the sandbox. Then those cookies belong to the agent.

The company is not asking “allow agentic actions on this site?” for every host. Repeated low-signal prompts, it argues, train people to click through. Warnings are reserved for actions a reasoning model flags as off-intent. The agent also cannot open internal pages such as brave://settings, non-HTTPS sites, Chrome Web Store extension pages, or hosts flagged by Safe Browsing.

THE AGENT’S HARD STOPS

• Your main logins: The agent profile does not inherit cookies or saved site data from regular windows.
• Internal pages: brave://settings and other brave:// surfaces stay out of reach.
• Cleartext and store pages: Non-HTTPS sites and Web Store extension pages are blocked.
• Flagged sites: Safe Browsing blocks apply inside the agent session.
• Off-intent acts: A misaligned plan triggers a warning and needs explicit permission.
• Saved memory: Anything Leo wants to remember is shown first, and you can undo it, so a page cannot park a hidden instruction in long-term memory unseen.

Sessions stay in an open tab, not a hidden sidebar. You can inspect and pause them. The agent cannot wipe its own logs. The profile is styled unlike Leo’s normal chat, the way Private Windows already look unlike regular ones, so it is harder to forget which mode you are in. Leo may suggest a browsing action from a prompt. It cannot start AI browsing on its own.

A Second Model That Never Sees the Page

Isolation is the blunt tool. The finer one is a second model Brave calls an alignment checker. It sees the system prompt, the user prompt, and the task model’s reply. It does not get raw page text. The idea is to keep untrusted HTML away from the referee. Brave also writes its own security-aware system instructions and says it uses models trained to resist prompt injection, including Claude Sonnet.

The same post is plain about the leftover risk. Guardrails are not proof of safety. Task-model output can be twisted by page content into an attack on the checker itself. Models are not deterministic, so the same ask can produce different clicks. A second failure mode needs no attacker at all: the model can simply misread you and do harm.

Brave names those two threats in one list. A hostile page can inject instructions. The model can get confused. The company says any agentic browsing product should defend both. It also says it is trying to avoid a permanent whack-a-mole cycle of patching each new trick in isolation, which is why the profile split sits under the model tricks rather than the other way around.

On privacy, Leo’s agent follows the same no-logs line as the rest of Leo. Chats are not kept on servers, not used to train models, and not tied to a stored IP in chat requests, in Brave’s own comparison against Comet, Gemini, ChatGPT, and Copilot. Ads and trackers still get blocked while the agent works. The company stresses that AI browsing never trains on your data, which it says other agentic browsers do not match.

University of Washington Put Brave in the Safer Group

Independent testers reached a similar split. Franziska Roesner and David Kohlbrenner at the University of Washington’s Paul G. Allen School ran same-origin tests on seven agentic browsers in late January and early February 2026, then posted the paper site on April 15, 2026. UW News carried the findings on June 30, 2026.

They asked a basic browser question. If a hostile page can trick the agent, can that agent then read or act on another origin in a way classic page scripts cannot? In the weakest designs, they wrote, the same-origin policy shrinks to whatever prompt-injection defense the model still has.

THE IFRAME TEST

Atlas in Agent Mode was the end-to-end steal: a page with an embedded foreign frame, a summarize ask, a hidden instruction, and a form that shipped the extra content out. Chrome with Gemini, Claude for Chrome, and Comet met the preconditions if a prompt injection landed. Claude worried them extra because it is an extension that can inject script into pages. Researchers grouped Microsoft Edge with Copilot in those tests with Brave on the limited side.

Browser agents aren’t ready for the public.

David Kohlbrenner, assistant professor, University of Washington

Roesner said the lab had useful exchanges with people at Google, Microsoft, and Brave. Vendors got more than 60 days’ notice. Brave, Google, and Microsoft sent acknowledgments. She also said companies are shipping under competitive pressure, and that after decades of same-origin work this is a step back for browser security. The paper’s own close is the trade the whole category is stuck in. The strict agents hand the model a narrow, pre-shaped view of the page, which caps what they can do. The loose ones act like a person at the keyboard, which cuts against 30 years of web rules.

Double Pay for Anyone Who Breaks It

Brave did not pretend the Nightly build was a finished vault. The launch post invited GitHub bugs and sent security reports to HackerOne. In the early release, it said valid in-scope AI-browsing issues would get double the usual bounty amounts. The program added its LLM and AI Agent Security section on November 26, 2025, and described a temporary doubling for in-scope LLM and agent issues that show real security impact.

USUAL BOUNTY RATES

• Low: $100
• Medium: $250
• High: $500
• Critical: $1,000

Jailbreaks, nasty prose, hallucinations, and tricks with no security effect go to ai-safety@brave.com, not the paid queue. A prompt injection counts only if it leaks or changes data, or performs an unauthorized act with clear security impact, and only if the model leaves the user’s intent without being told to. Attacks that need the user to paste the evil prompt, or to say “follow the instructions on this page,” are out. So are theoretical write-ups with no working hit.

That bar is how a privacy company asks to be attacked in public. Testers who still want the feature use how to turn on AI browsing: open brave://flags, enable “Brave’s AI browsing,” then use the control in Leo’s message box. Some help pages also name the flag as #brave-ai-chat-agent-profile. Feedback sits on Brave’s Leo community board. Bug reports go to github.com/brave/brave-browser or HackerOne.

Daily use is still a live question. In March 2026 a Brave-adjacent account asked whether anyone ran agentic browsing every day, or even every week, across Atlas, Comet, and Brave. The launch thread also drew a simpler complaint from people who bought Brave to block trackers and did not want an agent in the same window.

Shopping Demos Still Need a Fresh Login

The safer architecture is also the less magical one. A blank profile can research public pages, compare prices that do not need an account, and draft text. It cannot finish “buy the thing I always buy” until you sign that profile into the store. It cannot file the travel change until you sign it into the airline. It cannot summarize the unread thread until you sign it into mail.

Do that, and the session Brave kept out of the agent is now inside it. A hostile page that poisons the next summarize ask is no longer reaching at a wall of empty cookies. It is reaching at whatever you just typed into the sandbox. Isolation still caps the blast to that profile. It does not cancel the class of bug Brave spent the autumn of 2025 demonstrating on everyone else.

The shopping demo still works if you sign that blank profile into the store yourself. Then the cart-and-mailbox hijack from the Comet write-ups is back in play, only inside Brave’s own agent, and the bounty page remains open.