Let’s talk about the browser that died last month, and the fight underneath it that nobody actually lost — because it was never really about the browser.
On 9 July, OpenAI said it was shutting down Atlas. Nine months after it launched. Users were told to move to a supported browser before 9 August, because Atlas was being discontinued and would stop getting the security updates a live browser is supposed to get.
An entire product. A whole launch cycle. A whole category of think-pieces about the AI browser being the next platform. Gone in about the time it takes to get a bond approved.
But the interesting part isn’t that it died. It’s how it died.
OpenAI didn’t walk away from browsing. It moved the browsing agent into the ChatGPT desktop app and a Chrome extension. So the agent survived. The browser wrapper is what got cut.
Google did it the other way round from the start. Its agent lives inside Chrome. Which is why the reach is so lopsided — nobody had to install anything, nobody had to move, nobody had to log in again. And Perplexity is the one still asking people to pack up and relocate: Comet, a standalone AI browser, plus its Computer product, at a monthly number that has stopped being casual.
So you’ve got two distribution strategies in the same market. One asks you to change where you live online. The other one just moves into the room you were already standing in.
That’s not a product lesson. That’s the whole game.
Because the browser stopped being a window a while ago. It’s the place your logins live. Your bank, your work email, the clinic portal, the school app, the shop account you’ve had since 2014. The browser holds the session. It holds the version of you that every other system on the internet already agreed is you.
So when an agent runs inside that, it doesn’t introduce itself. It doesn’t prove anything. As far as every website is concerned, it is you — because it’s carrying the same cookie you’d be carrying. That’s the entire promise. It’s also the entire problem.
Picture the mechanics. You tell your assistant: buy the thing, book the slot, cancel the subscription. It opens the tab, it’s already logged in, it clicks. To the website, that’s a person who knows the password doing a normal thing. There’s no handshake. There’s no moment where the site asks who’s actually driving.
The agent’s authorization is your login. That’s it. And your login was never a permission slip for a third party to act on your behalf. It was a key you left in the door.
That is what the Amazon case was really about, and almost nobody read it that way.
Back in March, a federal judge in California handed Amazon a preliminary injunction against Perplexity. The order blocked Comet from accessing Amazon customer accounts and buying on their behalf. And the wording is the part worth keeping: the court found strong evidence that Comet accessed a password-protected account with the user’s permission but without Amazon’s authorization.
Read that distinction again. The person said yes. The platform said no.
Perplexity’s argument was fair on its face — these are my users, they told me to buy the thing, that’s consent. The court’s answer was that consent between you and your agent doesn’t manufacture authorization from the website you’re logging into. And underneath the ruling, Perplexity was ordered to destroy the Amazon customer data it had collected along the way.
That’s the fight. Not “are agents cool.” Not “is the browser dead.” The fight is who gets to decide what a logged-in session is allowed to do, and who is legally standing there when it does it.
And there’s a second-order effect the builders haven’t priced in yet. If the session is the moat, the agent war stops being about models. All these companies have roughly comparable models. The difference is who’s holding the keys to the login jar. Google has Chrome. Apple has Safari and the phone. Microsoft has Windows, Edge, and the enterprise directory. OpenAI just discovered it could not buy its way into that position in nine months, so it retreated to the surfaces it already owned.
The standalone browser was never a product. It was a land grab for the session — and the incumbents were never going to hand it over.
Now here’s the part that should irritate you slightly.
Every company in this fight has shipped the same answer to “an agent is acting as you inside a session and might do something stupid.” A confirmation dialog. Agent mode with safety limits. A “require human review” toggle. Inline action confirmations. And researchers have already demonstrated prompt-injection attacks that get an agent to leak data from another site you happen to be logged into — because that’s the inherent weakness. An agent holding your session can read everything your session can read, while taking instructions from text it just read on a page somebody else controls.
So the safeguard is: you, clicking yes, one more time. Which is the same safeguard we already have and already ignore. You don’t read the cookie banner. You won’t read the agent’s plan either.
For the operators: distribution stopped meaning “where do people find you.” It means “whose session do you get to inherit.” If you’re building anything agent-shaped, the asking price of a standalone surface is that every single user has to re-establish identity somewhere new. And they won’t, at scale. The category keeps proving it.
So either you build inside a session someone already trusts — and accept the landlord. Or you build something the session holder cannot absorb into their own product, which is rare and getting rarer. Or you try the court route and force the door, which is expensive and currently not going well for the people doing it.
And for the rest of us, the question gets simpler and stranger at the same time.
Everything we’ve been told about the agent era assumes the hard part is capability — whether the machine can do the thing. It can. The hard part is standing. Who authorized this act? On whose behalf? Under what agreement, verifiable by whom, revocable when?
Right now the honest answer is: whatever your login said.
Which means the most valuable identity document you own isn’t your passport. It’s a session token sitting in a browser profile, handed to an assistant you never audited, and it cannot tell anyone who it’s actually working for.
We spent thirty years teaching machines to recognise us. We’re about to find out that recognising a password is not the same thing as recognising a person.
That was the question the browser war was asking the whole time. Not which app you open. Who’s logged in when it opens.