ChatGPT Atlas
Last reviewed
May 17, 2026
Sources
36 citations
Review status
Source-backed
Revision
v2 · 5,230 words
Improve this article
Add missing citations, update stale details, or suggest a clearer explanation.
Suggest edit
CtrlK
Last reviewed
May 17, 2026
Sources
36 citations
Review status
Source-backed
Revision
v2 · 5,230 words
Add missing citations, update stale details, or suggest a clearer explanation.
ChatGPT Atlas is an AI-powered web browser developed by OpenAI. It was announced and released on October 21, 2025, initially as a macOS-only download with a free tier and additional capabilities for paid ChatGPT subscribers [1][2]. Built on top of the Chromium open-source project, Atlas places ChatGPT at the centre of the browsing experience: a sidebar called the Ask ChatGPT companion runs alongside any web page, a feature named Agent Mode lets ChatGPT navigate websites and complete multi-step tasks on the user's behalf, and an opt-in browser memory stores context from past sessions so the assistant can reason about what the user has been doing [1][3].
Atlas was unveiled in a livestream hosted by Sam Altman on October 21, 2025. Altman called the launch "a rare, once-a-decade opportunity to rethink what a browser can be" and argued that web browsers had not meaningfully changed since the introduction of tabs [4][5]. The product became OpenAI's first consumer browser and slotted directly into a wider race to put AI agents inside the browser surface, putting Atlas in head-to-head competition with Perplexity Comet, which had launched in July 2025, and Dia browser from The Browser Company, which had reached general availability on macOS two weeks earlier on October 8, 2025 [6][7].
Within days of the launch, security researchers published a series of indirect prompt injection attacks against Atlas, including a clipboard hijack and an Omnibox jailbreak from Brave, and a memory-poisoning vulnerability from LayerX. The findings prompted a public response from OpenAI's chief information security officer, Dane Stuckey, who said agentic browsing represented a "frontier, novel" security problem and that the company was still actively investing in mitigations [8][9][10]. By late December 2025, OpenAI publicly conceded that prompt injection was "unlikely to ever be fully solved" and framed agentic browser defense as a continuous arms race rather than a problem that could be closed by a single fix [28][29].
OpenAI's interest in shipping its own browser had been public for most of 2025. Reuters reported in July 2025 that the company was "close to releasing" an AI-powered web browser, framing the project as a direct attempt to challenge Google Chrome by routing user interactions through ChatGPT rather than a search engine [11][12]. The same reporting noted that OpenAI had hired two former Google vice presidents from the Chrome team, Ben Goodger and Darin Fisher, in 2024 to lead browser engineering. Goodger had been one of the original engineers on the Chrome project.
OpenAI had shipped a browser-based agent called Operator in January 2025, which ran inside a virtualized cloud browser and let ChatGPT Pro subscribers delegate web tasks to a remote agent. Operator was retired in mid-2025 and folded into a feature called ChatGPT Agent inside the main ChatGPT app, which combined cloud browsing with the assistant's reasoning. Atlas extended that direction onto the user's own machine, so the assistant could drive the user's local browser with access to their existing logins [1][13].
By the autumn of 2025 the major AI labs were converging on the idea that the next consumer surface for AI was the browser. Google had added Gemini-powered features inside Chrome over 2024 and 2025, Microsoft had introduced a Copilot Mode inside Edge, and Perplexity had shipped Comet to Perplexity Max subscribers in July 2025 before making it free worldwide on October 2, 2025 [14][15]. The Browser Company released Dia in beta in June 2025 and made it generally available on macOS on October 8, 2025, then sold itself to Atlassian for $610 million on the same day Atlas launched [7][16]. Atlas therefore arrived in a saturated launch window.
Industry analysts framed the moment as a possible structural attack on Google's search business. Routing the entry point for web tasks through an AI assistant threatened the Google Search advertising model on which Alphabet earned roughly three-quarters of its revenue [4][17]. Alphabet's stock fell on the day of the Atlas launch.
OpenAI announced Atlas on its company website on October 21, 2025 in a post titled "Introducing ChatGPT Atlas: a new web browser with ChatGPT built in." The post and a livestream keynote at 10am Pacific time on the same day described the product and made it available for download on macOS through the official chatgpt.com/atlas page. Sam Altman led the keynote, joined by product lead Adam Fry, design lead Pranav Vishnu, head of ChatGPT Nick Turley, and other members of the applications team [4][5].
Altman argued that chat is the new way to interface with the internet, that the browser is the right surface to embed it, and that an AI assistant with persistent memory and access to a user's tabs can act on their behalf in ways a traditional browser cannot. He acknowledged that browser switching is "hard" and that Atlas would need to be markedly better than incumbents to win share. The team committed to Windows, iOS, and Android builds in the months following [4][18].
The initial download was free for all users with a ChatGPT account. Agent Mode, the autonomous browsing capability, was restricted at launch to Plus, Pro, and Business subscribers. The product passed through OpenAI's standard enterprise compliance review for the Business tier, including SOC 2 controls inherited from the broader ChatGPT line [1][18].
Atlas presents itself as a familiar Chromium browser with the assistant promoted to a first-class component of the interface. The address bar doubles as a ChatGPT input, every tab can be opened in a ChatGPT-led mode where the assistant runs as a sidebar companion, and a separate Agent Mode lets the assistant take over the browser to complete tasks on the user's behalf.
| Feature | Description |
|---|---|
| Ask ChatGPT sidebar | A persistent right-hand panel that reads the active page and lets the user chat, summarise, compare, draft, or fact-check without leaving the tab [1][3]. |
| Agent Mode | Autonomous web automation. ChatGPT can navigate sites, click through forms, add items to carts, and complete multi-step tasks while the user watches. Restricted to Plus, Pro, and Business at launch [1][4]. |
| Browser memory | Optional persistent memory of recent browsing sessions that the assistant can reference. Off by default and opt-in. Atlas retains browsing summaries for 30 days and deletes per-page content snapshots within 7 days [1][3][30]. |
| ChatGPT in the omnibox | The combined address bar routes URLs to navigation, queries to ChatGPT, and natural language commands to either chat or a confirmation prompt for an Agent task [1][4]. |
| Cursor chat on page | An inline writing helper that rewrites or continues text inside any web text field, modelled on the cursor-level rewrites in macOS apps [1]. |
| New tab page | A landing page that combines a ChatGPT prompt box with shortcut tiles, recent tabs, and suggested actions from prior conversations [1]. |
| Chrome import | A first-run import wizard for bookmarks, passwords, browsing history, autofill data, and tab groups from Chrome and other Chromium browsers [1][18]. |
| Tab groups and split view | Standard Chromium tab management features inherited from the base engine, augmented by a native split-pane layout for side-by-side reading. A dedicated tab groups manager and vertical tab strip were added in subsequent updates [1][30]. |
| Privacy mode | A browsing mode that prevents Atlas from saving page content into ChatGPT memory or training data. Users can toggle it per tab or globally [1][3]. |
| Logged-out Agent Mode | A scoped Agent Mode session that runs without access to the user's signed-in accounts, recommended by OpenAI as the default when the task does not require authenticated sites [28]. |
| Sign-in with ChatGPT | Single sign-on into Atlas using an existing ChatGPT account, including SSO for enterprise users on the Business plan [18]. |
| Extensions | Atlas supports Chromium extensions, with the same compatibility surface as Chrome for the most part. OpenAI flagged at launch that some extensions might not work because Atlas runs a stripped-down release channel of Chromium [1][19]. |
The sidebar companion is the most visible new surface in Atlas. It reads the current tab, which the user can confirm or restrict per site, and answers questions, summarises, or rewrites copy without leaving the page. The companion can also reach into a user's ChatGPT memory if enabled, and into the Atlas-specific browser memory layer if the user has opted in [1][3].
Agent Mode is the more contentious addition. When a user invokes it, Atlas takes control of the active tab and begins clicking, typing, and scrolling on the user's behalf. The assistant narrates each step in the sidebar; a user can pause or take back control at any time. At launch OpenAI suggested workflows like booking restaurants, comparing flight prices, and filling in long forms. OpenAI publicly noted that the agent could be slow, confused by complex interfaces, and tricked by adversarial page content [4][9][10].
The first six months after launch saw a steady cadence of Atlas updates that addressed early reviewer feedback and competitive gaps relative to Comet and Edge with Copilot Mode.
| Date | Release | Notable additions |
|---|---|---|
| November 2025 | Atlas 1.1 series | Vertical tab strip, iCloud Keychain password import, refined sidebar layout [30]. |
| December 2025 | Atlas 1.2 series | Adversarially trained Agent model rollout, logged-out Agent Mode option, expanded user confirmation prompts before payments and data sharing [28][29]. |
| January 2026 | Atlas 1.3 series | Tab groups manager, an "Auto" search mode that blends ChatGPT answers with Google results in the omnibox, profile switching [30]. |
| March 2026 | Unified desktop roadmap | OpenAI announced plans to merge Atlas, the standalone ChatGPT app, and Codex into a single desktop application over the course of 2026 [30]. |
The Auto search mode introduced in January 2026 was an explicit response to reviewer feedback that the omnibox was too aggressive in routing simple navigational queries through ChatGPT, which added latency relative to a normal search engine. With Auto turned on, Atlas runs a lightweight classifier on the query, sends short factual queries to a traditional search result list, and reserves ChatGPT for ambiguous or multi-step prompts [30].
Atlas is built on the Chromium open-source project, the same engine that powers Chrome, Edge, Brave, Comet, and Dia. Building on Chromium gives Atlas immediate compatibility with the modern web, the Chrome extension ecosystem, and the standard set of developer tools and security primitives. OpenAI did not announce a target Chromium channel at launch, but the initial builds tracked recent stable Chromium milestones [1][19].
The assistant is powered by the same models that drive the ChatGPT product family, with model routing decided server-side. OpenAI did not publish a fixed list of models that handle Atlas requests; reporting at launch suggested the product used a mix of GPT-4o, GPT-5 family, and the o-series reasoning models depending on task type, with Agent Mode tasks routed to models trained for tool use and web navigation [1][20]. The system prompt and context are managed by OpenAI's servers, not by the local browser, so the local machine sends snapshots of page contents and user prompts to the model and receives back assistant responses and Agent Mode action plans.
Browser memory is a separate feature from ChatGPT memory, although they are related. ChatGPT memory, introduced in early 2024, stores user-supplied facts across chats. Browser memory in Atlas stores summarised observations of pages visited, queries entered into the omnibox, and Agent Mode task histories. Both are user-visible and clearable from a settings page. The Atlas privacy policy stated at launch that browsing history is not used to train models by default and that page contents shared with the assistant are subject to the standard ChatGPT data controls [1][3].
Atlas uses a per-process security model inherited from Chromium and a stricter sandbox for Agent Mode actions. The agent runs as a separate browser process that interacts with the rendered DOM through Chromium's accessibility tree and a structured action API, rather than by injecting JavaScript into the page. OpenAI described this in launch documentation as a way to keep Agent Mode auditable and to limit the blast radius of an agent action gone wrong. Security researchers later argued that this design was not enough to stop indirect prompt injection, where adversarial text embedded in a page hijacks the assistant's instructions [8][9][10].
Atlas launched on macOS on October 21, 2025 and committed to Windows, iOS, and Android builds in the months that followed. As of May 2026, only macOS remains officially supported. The other platforms have slipped past the soft targets implied at launch.
| Platform | Status as of May 2026 | Notes |
|---|---|---|
| macOS | Released October 21, 2025 [1][2] | Requires macOS 13 Ventura or later. Universal binary. Regular point releases through the 1.x series. |
| Windows | Not released [30][31] | OpenAI confirmed Windows is in development; internal builds were reported in early 2026 but no public release had shipped by May 2026. |
| iOS | Not released [30] | Mobile build still listed as in development. Some Atlas features are mirrored inside the ChatGPT iOS app. |
| Android | Not released [30] | Same status as iOS. |
| Linux | Not announced [1] | No Linux build was mentioned in the launch keynote or in any update since. |
The Windows delay drew particular attention because Perplexity Comet shipped a Windows build by March 2026 and took a clear lead on cross-platform reach among the agentic browser cohort [31]. A January 2026 Windows-watchers report noted that the Edge team had pre-positioned upsell prompts inside Windows 11 in anticipation of Atlas's eventual arrival on the platform, reflecting how seriously Microsoft viewed the competitive threat [32]. OpenAI's release notes through April 2026 continued to list Windows as "coming soon" without a firm date, and a Metaculus prediction market on whether Atlas would ship on Windows by March 13, 2026 closed at a clear no.
Distribution at launch went through the chatgpt.com/atlas landing page rather than the Mac App Store, in part because Atlas relies on browser-level capabilities that the App Store does not permit. OpenAI began rolling Atlas out to users in waves, with sign-in tied to a ChatGPT account.
Atlas itself is a free download for anyone with a ChatGPT account. The differentiation between tiers shows up in which features are available inside the browser, primarily Agent Mode and the depth of model access.
| ChatGPT tier | Atlas access | Agent Mode |
|---|---|---|
| Free | Atlas browser, Ask ChatGPT sidebar, memory toggles [1][18] | Not included at launch. |
| Plus ($20/month) | Atlas with priority routing and higher message caps [1][18] | Included. |
| Pro ($200/month) | Atlas with highest model access and priority routing [1][18] | Included, with higher session limits. |
| Business | Atlas with SSO, admin controls, and data exclusion defaults [1][18] | Included, subject to admin policy. |
| Go | Atlas browser, Ask ChatGPT sidebar [1] | Not included at launch. |
At launch OpenAI did not introduce a new subscription tier specifically for Atlas. The browser leaned on existing ChatGPT subscriptions, which Sam Altman framed in interviews as a way to make Atlas "as easy to try as Chrome" without forcing users to subscribe upfront [4][18].
The most serious public criticism of Atlas in its first weeks involved prompt injection. Indirect prompt injection attacks plant adversarial instructions inside a web page, an image, an email, or a clipboard, and rely on the AI assistant to read and follow those instructions when it processes the content. Because Atlas's sidebar and Agent Mode read page contents as part of normal operation, both surfaces are exposed to this class of attack.
Brave's security team published a series of disclosures during August through October 2025 that targeted Comet, Dia, and Atlas. The Atlas-specific entries included a clipboard hijack, in which an Agent Mode action could be diverted into executing a clipboard-loaded prompt, and an Omnibox jailbreak that bypassed safety routing for the address bar by formatting a request as a structured query. Brave argued in its writeups that the underlying weakness was an architectural one across agentic browsers and not an Atlas-specific bug [8][21].
LayerX, a separate security firm, demonstrated a memory-poisoning attack against Atlas in late October 2025. A malicious site induced the assistant to write false context into Atlas's browser memory, which then influenced later sessions where the user had no obvious reason to suspect the memory was tainted. LayerX's writeup framed memory poisoning as a particularly dangerous variant of indirect prompt injection because the malicious context persists across sessions, including across reboots [9][22].
Dane Stuckey, OpenAI's chief information security officer, responded publicly within the same week. In a thread on X and an accompanying company blog post, Stuckey called prompt injection "a frontier, unsolved security problem" and said OpenAI had built defenses including model-level safety training, runtime instruction filtering, structured action APIs, user confirmation prompts before risky actions, and a continuous red-team program. He committed to publishing more documentation on Agent Mode's defenses and to working with the wider research community on the underlying problem [10][23].
On December 22, 2025, OpenAI published a follow-up technical post titled "Continuously hardening ChatGPT Atlas against prompt injection attacks." The post documented a security release that shipped an adversarially trained Agent Mode model alongside surrounding runtime safeguards, and disclosed the methodology OpenAI had used to find and patch new injection paths [28][29].
The central novel element was an automated red team. OpenAI built a separate large language model trained end-to-end with reinforcement learning to act as an attacker against a simulated Atlas Agent. During its chain of thought reasoning, the attacker proposed candidate injections and sent them to an external simulator that ran a counterfactual rollout of how the targeted victim agent would behave, then scored the outcome. Successful attacks fed back into both the attacker (to find harder cases) and the victim agent training set (to produce a more resistant model). OpenAI reported double-digit percentage improvements in resistance to held-out attacks after several rounds of this loop [28][29].
In the same announcement, OpenAI conceded an important point in plain language: prompt injection, much like scams and social engineering on the open web, is "unlikely to ever be fully solved." The company framed agentic browser security as an ongoing arms race rather than a problem that could be closed by a single fix, and committed to a continuous schedule of red-team-driven hardening releases [28][29][33].
Alongside the model update, OpenAI rolled out user-facing recommendations: use logged-out Agent Mode when authenticated access is not required, write narrowly scoped prompts rather than broad instructions, and require step-up confirmation for sensitive actions such as payments or data sharing. These recommendations matched advice that Brave and Simon Willison had been making since October 2025, and the December update brought the official OpenAI guidance in line with the independent security community [28][29].
Independent commentators were mixed on whether these defenses were adequate. Simon Willison, who has tracked prompt injection research since 2022, wrote that the attacks against Atlas were "exactly what you'd expect" and that OpenAI's defenses were stronger than nothing but not a solution. He argued that until a fundamental defense against indirect prompt injection exists, users should treat agentic browsing as inherently risky and avoid it on high-stakes accounts such as banking or work email [24]. Brave's team made a similar point, suggesting users disable Agent Mode for tabs that include content from sources they do not control.
A related concern, voiced by privacy advocates, was that Atlas's browser memory feature combined with ChatGPT memory created a long-lived behavioural profile of the user, hosted on OpenAI's servers, with content that included page-level browsing data. OpenAI's response was to point at the per-site memory controls, the privacy mode toggle, the data exclusion defaults available on the Business tier, and the 7-day window after which page content snapshots are deleted from Atlas's memory store [3][18][30].
Atlas, Perplexity Comet, Dia browser, and Microsoft Edge with Copilot Mode all embed an AI assistant in the browser surface but differ in how much autonomy they give that assistant.
| Browser | Released | Built on | Default assistant | Agent autonomy | Free tier | Platforms (May 2026) |
|---|---|---|---|---|---|---|
| ChatGPT Atlas | October 21, 2025 [1][2] | Chromium | ChatGPT sidebar with Agent Mode | High. Agent Mode performs multi-step web tasks on Plus, Pro, Business [1][4]. | Yes for the browser itself. Agent Mode gated to paid tiers. | macOS only [30] |
| Perplexity Comet | July 9, 2025 paid, October 2, 2025 free worldwide [6][15] | Chromium | Perplexity assistant with Comet Assistant | Medium to high. Comet Assistant does multi-step tasks. | Yes from October 2, 2025. | macOS and Windows [31] |
| Dia browser | June 11, 2025 beta, October 8, 2025 GA on macOS [7] | Chromium | Dia chat with Skills | Low. Reads and writes inside open tabs, no general DOM automation. | Yes with usage caps, Dia Pro at $20/month for unlimited. | macOS only |
| Arc Search | 2024 | Custom (Chromium engine on iOS) | Arc Search browse-for-me | Medium. Aggregates and summarises results, no full DOM control. | Free. | iOS only |
| Microsoft Edge Copilot Mode | 2025 update to Edge | Chromium | Microsoft Copilot | Medium. Tab-aware actions and some workflow agents. | Free with optional Copilot Pro at $20/month. | Windows, macOS, mobile |
| Google Chrome with Gemini | Ongoing | Chromium | Gemini in Chrome | Low to medium. Page summarisation and write assistance. | Free with optional Gemini Advanced at $20/month. | All major platforms |
Reviewers covering the launch generally placed Atlas at the high-autonomy end of this spectrum. The Verge's Tom Warren wrote that Atlas's Agent Mode was the most aggressive consumer agent shipping inside a browser as of October 2025, with the largest set of actions it would attempt by default. TechCrunch's Maxwell Zeff described Atlas as "more ambitious than Comet, less polished than Dia" and predicted that the competition between the three would push all of them forward quickly. Wired ran a longer piece arguing that the browser was now "the most strategic surface in AI" and that whoever owned the entry point to web tasks would own a meaningful share of consumer AI revenue [4][18][25].
Atlas distinguished itself from Comet on memory and from Dia on autonomy. Comet leaned harder on the answer-engine surface inherited from the Perplexity search product, with citations and source panels promoted in the UI; Atlas leaned on the chat surface inherited from ChatGPT, with memory and Agent Mode promoted instead. Dia did not ship a full Agent Mode at all and remained the most conservative of the three.
A second-wave round of reviews in early 2026, after each product had iterated for several months, settled on a rough division of labour. Atlas was rated strongest for research and data extraction across multiple pages, where the ChatGPT model could carry context across sites. Comet was rated strongest for fast factual lookups and for cross-platform availability after its Windows release. Dia was praised for workflow automation inside open tabs but was held back by the absence of a full Agent Mode [34][35]. The lack of a Windows build for Atlas became the most-cited disadvantage in head-to-head Windows-user comparisons [31][34].
Launch coverage was widely positive on ambition and cautious on execution. The Verge described the product as "the clearest sign yet that OpenAI wants to own the consumer browser" and praised the sidebar's tight integration with ChatGPT memory, while flagging that Agent Mode was visibly unfinished and that prompt injection risks were already public [4]. TechCrunch led with a piece headlined "OpenAI's ChatGPT Atlas is a browser built for the agent era," focusing on the Agent Mode demos and on Altman's framing of the browser as a once-a-decade opportunity [18]. Wired covered the strategic stakes and the Alphabet stock reaction.
Sam Altman amplified the launch on his X account in a series of posts during October 21 and 22, 2025. He framed Atlas as a step toward a long-promised "agent-first interface" for the web and wrote that he expected agents inside Atlas to replace many tasks people currently do by hand. He also acknowledged the security work that remained, writing in one widely shared post that prompt injection was a "hard problem" that the industry would have to keep working on [26].
Developer commentary was more divided. Simon Willison, in a long blog post on October 22, 2025, wrote that he had been an early tester and that he found the assistant useful for summarisation and writing but did not trust Agent Mode with anything sensitive. He repeated his standing position that indirect prompt injection has no good defense and concluded that he would not enable Agent Mode on his personal browser [24]. Hacker News discussion threads in the days following the launch focused on the same theme: a substantial subset of the audience believed agentic browsing was structurally unsafe at launch, while a different subset argued that the productivity gains were real and that the safety problem was tractable with engineering.
Usage data published by OpenAI after launch was sparse. The company said in a November 2025 update that Atlas had been downloaded by "millions" of ChatGPT users, without giving a specific number, and that Agent Mode sessions covered shopping, research, and form-filling as the largest categories. Third-party analytics suggested Atlas had taken a small but visible share of the AI browser segment by the end of 2025, behind Chrome and Edge by orders of magnitude but in roughly the same range as Comet and Dia [17][27].
By early 2026, with the broader ChatGPT product line reporting roughly 900 million weekly active users and processing more than two billion prompts per day, third-party analysts estimated that Atlas could realistically capture between one and three per cent of the global browser market among heavy ChatGPT users on macOS, which translated to a potential addressable base of roughly twenty-five to one hundred million users if a Windows build shipped on schedule [27][36]. Actual deployed share remained well below the addressable ceiling. SimilarWeb's Q1 2026 AI browser report placed Atlas at low single-digit shares of the agentic browser segment, with Comet ahead on installed base thanks to its Windows availability [27][31].
Long-term coverage in early 2026 framed Atlas as one of several browsers competing for the same emerging surface rather than a runaway winner. Stratechery's Ben Thompson wrote in a January 2026 column that none of the AI browsers had so far broken Chrome's grip on the default browser slot but that the cohort had changed the conversation about what a browser is. Daring Fireball's John Gruber called Atlas's Apple Silicon performance good but its Agent Mode "unreliable in the demos I tried, but compelling in the ones that worked."
In March 2026, OpenAI announced that Atlas, the standalone ChatGPT desktop app, and the Codex coding agent would be merged into a single unified desktop application during the remainder of 2026 [30]. The merger was presented as a way to reduce surface duplication and to give users one place to chat, browse, and write code, but analysts read it as an admission that running three separate desktop products against the entrenched Chrome and Edge ecosystems was not the right shape of the long-term strategy.