AI Browser Agents in 2026: Claude, ChatGPT Work, and Gemini

On July 9, 2026, OpenAI shipped an agent that can spend hours building spreadsheets, slide decks, and internal dashboards from inside ChatGPT — and, the same day, announced it's shutting down the standalone AI browser it launched only eight and a half months earlier.¹² That one decision says more about the state of AI browser agents than any feature list: three of the biggest AI labs have now shipped one, and none of them has settled on what shape it should take.

In one line: By July 2026, Anthropic's Claude for Chrome, OpenAI's new ChatGPT Work, and Google's Gemini Auto Browse all let AI act inside your browser — but a new benchmark, OSWorld 2.0, shows even the best underlying model, Claude Opus 4.8, completes only 20.6% of realistic long, multi-step tasks.³

TL;DR

• What's new: OpenAI launched ChatGPT Work on July 9, 2026 — an agent that takes on hours-long, multi-step projects — and used the same announcement to confirm it's sunsetting the ChatGPT Atlas browser on August 9, 2026, less than ten months after Atlas launched.¹²
• Where the others stand: Anthropic's Claude for Chrome has been rolling out gradually since a 1,000-user pilot in August 2025 and reached all paid Claude plans in December 2025.⁴ Google's Gemini Auto Browse has been in desktop preview since January 2026 and only started reaching Android phones at the end of June 2026.⁵⁶
• The reality check: A brand-new academic benchmark, OSWorld 2.0, tested seven model families on 108 realistic, long-horizon computer-use tasks. The best performer — Claude Opus 4.8 with maximum thinking — fully completed just 20.6% of them.³
• Why agents still fail: OSWorld 2.0's own error analysis says agents aren't failing at clicking buttons or writing code. They lose track of constraints, miss information that arrives mid-task, guess instead of asking the user, and skip verification.³
• The common thread on safety: All three vendors converge on the same core defense — the agent has to ask before doing anything sensitive (buying something, posting publicly, deleting data) — because none of them has solved prompt injection outright.⁴

What You'll Learn

• What OpenAI shipped this week, and why it's killing its own Atlas browser to ship it
• Where Claude for Chrome and Gemini's Auto Browse actually stand right now, not at launch
• How the three vendors' approaches compare side by side
• What OSWorld 2.0 — a benchmark built specifically to stress-test these agents — actually found
• The specific ways these agents fail, straight from the benchmark's own error analysis
• What this means if you're deciding whether to deploy one of these agents today

What OpenAI shipped this week — and why Atlas is dying

ChatGPT Work is OpenAI's attempt to turn ChatGPT from a chat window into something closer to a coworker. OpenAI's own description: it's "an agent in ChatGPT that helps you take on more ambitious tasks," pulling information from connected apps and files to produce finished sheets, slides, docs, and web apps, and staying with a project for hours by breaking it into smaller steps it completes independently.¹ It's powered by GPT-5.6, which rolled out the same day.¹⁷

The rollout is staged: on web and mobile, Work went live July 9 for Pro, Enterprise, and Edu accounts, with Plus and Business following "over the next few days."¹ The bigger structural change is on desktop. OpenAI merged its Codex app into a new ChatGPT desktop app — Chat, Work, and Codex now live side by side there, available on every plan including Free, for Mac and Windows.¹ The prior desktop app was renamed "ChatGPT Classic."

That desktop app also ships a built-in browser and a "Computer Use" mode that lets ChatGPT click, type, and move files across a user's own apps and browser in the background, either as a one-off task or on a schedule.¹

OpenAI leaned on Codex's existing reach to justify the merge: more than 5 million people already use Codex weekly, and OpenAI says over 1 million of them now use it for work outside software development.¹ Early case studies OpenAI published alongside the launch describe Work being used to trace CRM data into a weekly executive dashboard at Zapier, turn manual monthly launch checks into a repeatable workflow at RingCentral, and cut a competitive-analysis project from weeks to hours at Virgin Atlantic.¹

The GPT-5.6 model underneath Work made news of its own the same day it shipped: it's the model that set a new high score on Agents' Last Exam, one of the hardest agent benchmarks published so far — a reminder that OpenAI was pitching this release on raw agentic-reasoning grounds, not just a product feature.⁷

Then comes the part that makes this a genuinely different kind of story than a routine feature launch: in the same post, OpenAI confirmed it is "sunsetting the standalone Atlas browser" and will walk users through migrating to ChatGPT.¹

Atlas — OpenAI's Chromium-based AI browser — launched for macOS on October 21, 2025, with Windows, iOS, and Android versions promised as "coming soon."⁸ Those other platforms never shipped; Atlas stayed macOS-only for its entire life. OpenAI's help center now lists August 9, 2026 as the date Atlas stops working entirely, with user data — bookmarks, browsing history, open tabs, cookies — not transferring automatically to anything else.² From launch to shutdown is 292 days, not quite ten months.

OpenAI's own framing is that Atlas was less a product than a prototype: the new browser-based agentic capability inside ChatGPT and Codex is built "on what we learned from Atlas," now folded into a surface with a far larger existing audience instead of a standalone app people had to go download.¹ It's a notable reversal for a company that, nine months ago, was trying to get people to switch their default browser.

Where Claude for Chrome and Gemini's Auto Browse actually stand

While OpenAI's move is brand new, the other two browser agents in this story have been shipping in slow motion for the better part of a year — worth knowing before comparing them against something that launched nine days ago. Anthropic's pilot predates even the run of computer-use headlines NerdLevelTech covered earlier this year, when an OpenAI model was reported beating humans at computer-use tasks back in April.

Claude for Chrome started as a genuinely cautious pilot. Anthropic's original August 25, 2025 post is titled "Piloting Claude in Chrome," and it opens with 1,000 waitlisted Max-plan users, not a public launch.⁴

Anthropic was explicit about why: internal red-teaming across 123 test cases covering 29 attack scenarios found a 23.6% prompt-injection attack success rate in the extension's "autonomous mode" before mitigations — malicious instructions hidden in a webpage or email could get Claude to take actions the user never asked for, including one documented case where a fake "mailbox hygiene" email got an early build to delete a user's emails without confirmation.⁴ Anthropic's safety mitigations cut that rate to 11.2%, and on a narrower set of four browser-specific attack patterns (things like hidden form fields in a page's DOM), the reduction was from 35.7% down to 0%.⁴

The extension expanded to all Max subscribers on November 24, 2025, then to every paid Claude plan — Pro, Team, and Enterprise — on December 18, 2025, the same update that added a Claude Code integration for testing code changes directly in the browser.⁴ As of that most recent dated update from Anthropic, it remains gated to paid plans; there's no indication of a further expansion since.

Gemini's Auto Browse followed a similar staged-rollout pattern, aimed first at desktop and only reaching phones months later. Google introduced Chrome auto browse on January 28, 2026, in preview for U.S. Google AI Pro and Ultra subscribers on Windows, macOS, and Chromebook Plus, built on Gemini 3.⁶ The Android version wasn't announced until May 12, 2026 — by then built on the newer Gemini 3.1 — and it didn't actually start reaching phones until "the end of June" 2026 — and even then only to "select devices" running Android 12 or higher with at least 4GB of RAM, restricted to the U.S. with the device language set to English-US.⁵

Google's own launch post is specific about what auto browse can do unsupervised versus what needs a human: its worked examples are booking a parking spot through SpotHero using details pulled from a ticket confirmation, and updating a recurring Chewy pet-food order — genuinely tedious, low-stakes browser chores.⁵ Google says the feature carries the same prompt-injection defenses as the desktop version and is designed to stop and ask for confirmation before anything sensitive, like a purchase or a public post.⁵

Broader (non-agentic) Gemini in Chrome features have a wider footprint: they expanded to Canada, New Zealand, and India with more than 50 additional languages starting March 11, 2026, available more broadly to desktop and iOS users in those regions — it's specifically the auto-browse capability that stays fenced off to paying AI Pro/Ultra subscribers.⁹

Worth flagging one more Anthropic product so it doesn't get conflated with Claude for Chrome: Claude Cowork, which Anthropic separately announced is expanding to mobile and web as of July 7, 2026, is a different surface aimed at synthesizing work across files and apps rather than driving a browser tab directly — the two are complementary, not the same product.¹⁰ Google runs a similar split: Auto Browse lives inside Chrome itself, while Gemini Spark, a separate persistent, cloud-hosted assistant with its own dedicated Gmail address, is a different shape of product again — not a browser feature at all.

Three vendors, three shapes: a side-by-side comparison

None of the three companies built the same thing. Laid out side by side, the differences in how each one gets access to "your browser" matter as much as any benchmark score:

The pattern: two of the three vendors have put a specific, falsifiable number on how often their defenses stop an attack — though Anthropic's and OpenAI's numbers measure different things (one product's autonomous mode versus a model's resistance to an internal automated attacker), so they aren't directly comparable to each other. Google, despite publishing real architectural detail, hasn't put a number on it at all.

The reality check: what OSWorld 2.0 actually found

Every one of the announcements above describes what these agents are supposed to do. A benchmark published a few weeks before all of them is a useful check on what they actually can do.

OSWorld 2.0, posted to arXiv on June 28, 2026 by the same xlang-ai research group behind the original OSWorld benchmark, was built specifically because agents needed a harder test.³ The original OSWorld measured shorter tasks — its own average was around 30 tool calls to complete a task. OSWorld 2.0 replaces that with 108 long-horizon workflows spanning everyday and professional computer use, each one a realistic end-to-end job that takes a human a median of about 1.6 hours and requires an average of 318 tool calls to finish (measured using Claude Opus 4.7 running at maximum thinking).³ That's roughly a tenfold jump in task length from the benchmark's predecessor.

The tasks are deliberately built to surface specific failure patterns that shorter benchmarks miss: streaming interaction and dynamic environments that change while the agent is mid-task, cross-source reasoning across multiple apps, implicit-state inference (figuring out something the task never states outright), and visual-spatial precision.³ Every task is grounded in real input files and realistic, stateful user-profile data, and the benchmark separately audits safety-sensitive actions rather than treating them as just another task type.³

Seven model families were evaluated: Claude Opus 4.8, Claude Opus 4.7, Claude Sonnet 4.6, GPT-5.5, Qwen3.7-Plus, MiniMax M3, and Kimi K2.6.³ Under the benchmark's primary metric — binary task completion within 500 steps — the best result belongs to Claude Opus 4.8 running at maximum thinking with batched tool calls: 20.6% of tasks fully completed, with a 54.8% partial-credit score.³

Claude Opus 4.8 itself shipped on May 28, 2026, so this is the model that was Anthropic's frontier release for computer-use tasks at the time of testing.¹³ GPT-5.5 lands well behind on the completion metric — the paper describes it as "far more token-efficient" than Opus 4.8, but its completion rate plateaus near 13%.³

One caveat worth flagging: GPT-5.6 Sol, the model powering ChatGPT Work, launched 11 days after this paper was posted and wasn't one of the seven models the authors tested. OpenAI's own GPT-5.6 launch materials separately report a 62.6% score on "OSWorld 2.0" for Sol — ahead of the 54.8% they list for Opus 4.8 — and state that on this benchmark it "surpasses Opus 4.8."⁷ That comparison comes from OpenAI's own evaluation run rather than the paper's independently administered leaderboard, and the figure OpenAI cites for Opus 4.8 (54.8%) matches the paper's partial-credit score, not the stricter binary-completion figure (20.6%) this section leads with — so it isn't a like-for-like challenge to that 20.6% number. But it does mean Opus 4.8's status as the top scorer isn't uncontested once a newer, differently-measured model enters the picture.

Read plainly: on a benchmark built from realistic, hours-long computer tasks, the best-performing configuration in the paper's own formal comparison still leaves roughly four out of every five tasks unfinished.

Why these agents still fail

The most useful part of OSWorld 2.0 isn't the leaderboard — it's the paper's own explanation of why the scores are this low. The researchers are specific that the bottleneck isn't what you'd assume from a benchmark called "computer use": agents aren't mainly struggling with basic GUI control or writing code that runs.³

Instead, the paper attributes failures to four recurring patterns: agents lose track of constraints partway through a long task, they miss information that shows up mid-task rather than being handed to them upfront, they guess rather than pausing to ask the user for a decision, and they skip verification steps that would have caught their own mistakes.³ The paper adds that agents struggle most specifically when a task hinges on hidden state they have to recover on their own — the kind of thing a human would just check by looking, and an agent has to infer.³

That description lines up with what all three vendors are quietly building around their own agents right now: OpenAI's "Auto-review," which uses a separate model pass to check sensitive actions before they execute; Anthropic's action confirmations, which force a stop before anything high-risk; Google's same confirm-before-purchase pattern in Auto Browse.¹⁴⁵ None of those mechanisms are trying to make the underlying model smarter at 300-step tasks — they're all, in effect, admission that the agent might get the multi-step reasoning wrong, and the safety net is a human checkpoint rather than a fix to the reasoning itself.

What this means if you're evaluating one of these agents

A few practical takeaways follow from putting this week's launches next to a benchmark that was specifically designed to be hard for them:

• Match the task length to what's actually been tested. OSWorld 2.0's own numbers are for tasks averaging 318 tool calls and a human time of 1.6 hours. A five-minute task (book this one parking spot, summarize this one page) is a fundamentally different — and much better-supported — use case than a multi-hour research or reporting project, even though vendor demos often show both side by side.
• Ask exactly what a vendor's safety number is measuring. Anthropic's 11.2% figure is specific to the Claude-for-Chrome extension running in autonomous mode. OpenAI's newest figure — GPT-5.6 Sol resisting 99.95% of attempts from its own automated red-teamer — is about the underlying model in general, not the ChatGPT Work product specifically, and was published nearly a week after ChatGPT Work itself. Google hasn't published a comparable success-rate number at all. None of these are the same measurement, so don't rank the three vendors by lining the percentages up next to each other.
• "Confirmation before sensitive actions" is doing most of the safety work industry-wide right now, not model-level judgment. Plan your own deployment around the assumption that the agent will occasionally attempt the wrong thing and needs a human checkpoint to catch it — because that's the same assumption every vendor here is building around.
• Don't treat a same-day product launch and shutdown as unusual. Atlas lasted 292 days. In a field where the underlying models are still this far from reliable on long tasks, expect more vendors to fold standalone bets into their main product rather than keep maintaining a separate app.
• Test on your own workflow, not the vendor's demo. A 20.6% top score on a benchmark built from real long-horizon tasks is a strong argument for piloting narrowly — on tasks closer to OSWorld 1.0's shorter scope — before trusting any of these agents with something that takes a human over an hour.

The Bottom Line

Three different companies now ship three different answers to "what should an AI agent in your browser look like" — a lightweight extension, a desktop app with a browser folded in, and a feature built into the browser itself. OpenAI's decision to kill its own nine-month-old browser bet in the same breath as launching ChatGPT Work is the clearest signal yet that none of the three has found the obviously right shape.

What all three converge on, without needing to coordinate, is that the model itself isn't yet trustworthy enough to run unsupervised — every one of them ships a version of "stop and ask before doing anything risky" as the actual safety mechanism. OSWorld 2.0's 20.6% top score on real, long-horizon tasks is the number that explains why: these agents aren't struggling to click the right button. They're struggling to hold onto the plot over a task long enough to finish it.