Agentic Browsers After Atlas: Gemini, Claude and Edge Admin Controls Compared

OpenAI's standalone Atlas browser lasted 292 days, from its macOS launch on 21 October 2025 to its shutdown on 9 August 2026. The agentic browser did not die with it. It moved into the browsers your company already manages, as Gemini in Chrome, Claude for Chrome and Copilot Mode in Edge. Those three ship with very different defaults, and the defaults decide your exposure more than any feature list does.

The short answer. For a managed fleet, Edge's browsing agent is the safest default because nothing runs until you allowlist sites. Gemini in Chrome keeps auto browse off for managed users but allows the sidebar unless you set GeminiSettings. Claude for Chrome is enabled for Team and Enterprise by default, so an admin who does nothing has already said yes.

Every control below comes from the vendor's own admin documentation, read in October 2026.

Why agentic browsing moved into Chrome and Edge after Atlas

An agentic browser is a browser that can act for you. It clicks, types, navigates and fills forms across tabs, rather than only answering questions about the page in front of you.

OpenAI tried to own that category with a whole browser. Atlas launched on macOS in October 2025 and never shipped for Windows. On 9 July 2026, OpenAI's James Sun posted that the company was "going to be sunsetting Atlas," as 9to5Mac reported the same day. It stopped working on 9 August.

The capability did not disappear. OpenAI folded a built-in browser into its new ChatGPT desktop app, and for work that needs an existing Chrome profile or signed-in session, it pointed users to its Chrome extension. That second detail is the real story. Even the company that built a standalone agentic browser concluded that the agent belongs inside the browser people already use.

The browser your IT team already manages won

Enterprise browsers come with years of policy plumbing: MDM profiles, extension allowlists, URL filters, DLP connectors and sign-in restrictions. A new browser has to rebuild all of that before a security team will approve it. An agent inside Chrome or Edge inherits most of it on day one.

You are no longer choosing a browser. You are choosing which agent you let inside the browser you already govern, and how much of that governance the agent respects. Our earlier walk through Comet Enterprise's admin controls against five published attacks covers the one standalone agentic browser still selling to enterprises.

The agentic browser admin controls table

Every cell traces to a vendor help page, policy reference or announcement. "Not stated" means the pages we read do not say, which is a finding in its own right.

Sources: Google Chrome Enterprise Help and release notes, Anthropic Help Center and Privacy Center, Microsoft Learn and the Microsoft Edge Blog. Read between 18 and 20 October 2026.

Gemini in Chrome enterprise: two switches and a quiet default

Gemini in Chrome is Google's assistant inside the browser. It answers questions about the current tab and, through a feature called auto browse, can complete multi-step tasks in Chrome tabs on the user's behalf.

According to Google's Chrome Enterprise help page, access needs two things switched on at once: the Gemini app setting in the Workspace Admin console and Chrome's GeminiSettings policy. Turning off either one turns off the feature.

The sidebar is on unless you say otherwise

Here is the default that catches admins. When GeminiSettings is unset in a managed browser, Google's table maps it to "Allow Gemini integrations". The only way to flip the default for all generative features at once is GenAiDefaultSettings set to 2, and Google notes that policy can only be set in the Admin console.

The rollout timing makes this matter. Google's release notes say Gemini in Chrome started rolling out to most US Workspace users with Gemini app access in Chrome 143, in December 2025. If your organisation had the Gemini app enabled and no Chrome policy set, your users got the sidebar by default. Google also says settings can take up to 24 hours to reach everyone, so a late policy change is not instant either.

Auto browse is off, and gated by edition

The acting part is handled more carefully. Auto browse reached enterprise users in Chrome 147, released on 25 March 2026, with three policies to govern it: GeminiActOnWebSettings, GeminiActOnWebAllowedForURLs and GeminiActOnWebBlockedForURLs.

Google's help page says auto browse "is currently off by default for managed users". It can only be enabled for specific editions: Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, two education tiers and two AI access add-ons. Business Starter is not on the list. With the user's permission, auto browse can also use Google Password Manager to sign in to sites, which is a capability your allowlist should account for.

On data, Google is direct. Under Workspace terms, Gemini does not use "prompts, your current tab context, or the generated responses to train generative AI models," and content is not human reviewed outside your domain without permission. One caveat sits in the same page: users without a qualifying edition can only be given access under consumer terms, which carry different data rules. Chrome 150 added a further policy, GeminiSparkSettings, for connecting Chrome to Google's Gemini Spark agent, which shows how quickly the policy surface is growing.

Claude for Chrome: an extension your users can install today

Claude for Chrome, which Anthropic's documentation calls Claude in Chrome, is a Chrome extension. It reads pages, takes screenshots of the tabs it works in, and clicks and types on the user's behalf. Anthropic says it is available on every paid plan: Pro, Max, Team and Enterprise.

That plan list is the first governance issue. A Pro subscription is a personal purchase. If your managed Chrome allows any extension from the Chrome Web Store, an employee can run an agent under their own account against your internal web apps. More on that in the piece on personal AI accounts as the new perimeter.

The owner toggle and the site lists

For Team and Enterprise organisations, owners manage the extension in Organization settings. The admin controls page states it plainly for Team plans: "The extension is enabled by default. Disable it if you prefer users not to have access." Enterprise is described the same way, on by default unless already disabled. HIPAA-enabled organisations are the exception, where it stays off until an owner turns it on, and Anthropic adds that it is not covered under the Business Associate Agreement.

Site control is a pair of lists. The allowlist names where Claude may work, and the blocklist names sites Claude "should never access, regardless of other settings." The same lists govern the browser inside Claude Cowork. Anthropic itself recommends starting with a restrictive allowlist, which is the opposite of the shipped default.

Two further controls deserve attention. The Chrome policy forceLoginOrgUUID restricts which Claude organisation the extension can sign in to, which closes the personal-account gap described above. And zero data retention is "not supported for Claude in Chrome," so organisations relying on ZDR elsewhere in Anthropic's products should not assume it carries over.

Permission modes decide the real risk

Claude's permissions guide names three modes. Manually approve asks before each action. Automatically approve lets Claude review each action and block what it judges unsafe. Skip all approvals means, in Anthropic's words, "nothing checks its actions automatically." In the Cowork side panel, the default is Automatically approve.

Some actions are prohibited in every mode: purchases, creating accounts, financial trades, permanent deletions and "completing instructions from emails or web content". That last rule targets prompt injection directly, the attack class explained in the breakdown of prompt injection against agents. Anthropic reports an attack success rate under 0.08% in internal testing, and says in the same paragraph that "the risk is not zero".

What the four help pages we read do not mention is an organisation-level audit trail of agent actions. Whether an admin can export a record of what the agent did across the organisation is not stated there.

Edge Copilot Mode: fail-closed by design

Microsoft announced Copilot Mode for Edge for Business on 18 November 2025. The launch post on the Edge blog described Agent Mode, a Copilot new tab page, a Daily Briefing, and reasoning across up to 30 open tabs. It also said Agent Mode and Daily Briefing require a Microsoft 365 Copilot licence.

By October 2026, Microsoft's admin documentation calls the acting feature "browsing with Copilot." Microsoft Learn describes it as letting Copilot "browse websites on a user's behalf, following their instructions to complete multi-step workflows". It is still marked preview, enrolment is by form, and only tenants outside the European Economic Area can take part.

Three policies before the first click

Edge's design starts from no. AllowBrowsingWithCopilot turns the feature on or off, and when it is not configured the feature is off by default, although users can turn it on. The decisive policy is the allowlist. If BrowsingWithCopilotAllowList is disabled or not configured, Microsoft's reference says browsing is "unavailable on all sites, even if the AllowBrowsingWithCopilot policy is enabled".

The block list "will always take precedence over the allow list," which gives admins the familiar pattern of allowing a broad set and carving out exceptions. Microsoft365CopilotChatIconEnabled must also be on, or the option never appears. All three policies need Edge 148 or later on Windows or macOS, and changes can take up to 90 minutes to reach devices. Microsoft also says Copilot pauses for user input on authentication steps and on final saving and submitting actions.

This is the right default for an acting agent.

Microsoft offers a toggle to "allow Copilot to browse the most commonly used sites for work." Its published domain list includes Microsoft and Azure properties, Google, Salesforce, Atlassian and Slack. It also includes anthropic.com, claude.ai, openai.com, chatgpt.com and reddit.com.

A single click therefore lets the agent act on a public forum and on rival AI chat services. We would not enable that toggle. Build the allowlist from the two or three internal workflows you are piloting, and add domains as they earn it.

Page context is a separate switch. EdgeEntraCopilotPageContext controls whether Copilot in the sidebar can read page content, browsing history and video transcripts for Entra users. When unset, it is on by default outside the EU and off inside it, and Copilot cannot read pages protected by DLP policies even when the setting is on. Microsoft's launch post states that prompts, responses and files stay within your tenant, with Microsoft "not using your data to train models or for advertising".

What an agentic browser seat costs

Price is where the three stop being comparable, because each one sells the agent differently. Google bundles it, Anthropic sells a seat, and Microsoft sells an add-on on top of a base licence.

Sources: Claude pricing page and Microsoft Copilot enterprise pricing page, October 2026. Google does not list a separate price for Gemini in Chrome. Negotiated and regional prices differ.

Two pricing details change the comparison. Claude Enterprise adds usage billed at API rates on top of the seat, so an agent that takes many screenshots will cost more than the headline. Anthropic's permissions guide also notes that automatic approval "consumes more of your usage limit." The rate card is in the Claude pricing and API rates breakdown.

For Microsoft shops, the decision is really whether the Copilot add-on pays for itself across Word, Outlook and Teams first. The browsing agent is a reason to buy it only if those already justify the $30. That trade-off is examined in the Copilot versus Gemini per-seat comparison.

Where this comparison is weakest

A comparison built on documentation inherits documentation's blind spots. Here are the three that matter most.

Documentation describes intent, not behaviour

Every cell in the table is what a vendor says its product does. None of it was tested here. Whether a blocklist entry holds against a redirect chain, or whether an agent truly pauses before a submit button, is behaviour you can only verify in your own environment. Vendor-reported security numbers, including Anthropic's 0.08%, come from internal testing that no third party has replicated in public. How well these agents complete tasks is a separate problem, covered in the analysis of computer-use agents against OSWorld.

Preview and beta labels mean the table will age fast

Two of the three acting features are not generally available. Microsoft renamed its feature between the November 2025 launch and the October 2026 docs, and the Edge launch post promised a public preview that the current Learn page still describes as form-based enrolment. Google has added a new Gemini policy in almost every Chrome release since 143. A policy you set in October may not be the policy that governs the feature in January.

There is also a fair case against our preference for Edge. A fail-closed agent that requires a $30 add-on and excludes EEA tenants is not an option for many readers at all. For a European Workspace customer, Gemini's auto browse with a tight allowlist may be the most governable agent actually available.

OpenAI's replacement is missing from the table

OpenAI did not leave the category. We searched for official admin documentation for its Chrome extension and found none, only third-party write-ups. Including it on that basis would break the sourcing rule this post is built on, so it is left out. If your staff already use ChatGPT Business or Enterprise, check the extension's controls with your OpenAI account team before assuming it is ungoverned. Our wider ChatGPT, Claude and Gemini enterprise governance comparison covers the controls OpenAI does document.

A rollout order for IT, whichever agent you pick

The order of operations matters more than the vendor. Most exposure comes from features that arrived by default, not from features anyone chose.

First, close the doors you did not open. Set GeminiSettings or GenAiDefaultSettings deliberately, rather than inheriting the unset default. If you run Claude Team or Enterprise, decide whether the owner toggle should stay on, and push forceLoginOrgUUID through your Chrome policy so the extension only signs in to your organisation.

Second, pick one workflow and one agent. A useful pilot is narrow: one internal web app, one team, a written allowlist of three domains and a blocklist covering email, password managers, banking and admin consoles. Keep approval on the strictest mode the product offers for the first month.

Third, decide what counts as a record. If you cannot produce a log of what the agent did when something goes wrong, you are running a demo, not a deployment.

Frequently asked questions

Where to start

Open your Google Admin console and your Claude organisation settings this week and write down the current value of GeminiSettings, GenAiDefaultSettings and the Claude in Chrome toggle. If any of them is unset, you have an agent policy you never chose, and setting it explicitly takes ten minutes.

Then send one question to whichever vendor you plan to pilot: can an admin export a per-user record of every action the browser agent took last month? The answer will tell you more about enterprise readiness than any feature page.

Related reading