The state of agentic browsers, August 2026.

Published August 6, 2026. All tests run 2026-08-06. Every product below was installed on the same Windows 11 machine (build 10.0.26200) and driven through the DevTools protocol on the same morning. The scripts and the unedited output are in the appendix.

Disclosure. Aera publishes this, and Aera is one of the products in the tables. We ran the same two tests against ourselves and reported the results in the same rows. Where we could not test something, including our own, the row says so.

Why these two tests

The interesting question in this category is not which agent writes the nicest summary. It is: when a vendor says a task runs while the browser is closed, where is it running? There are only two answers. Either something of theirs is still executing on your computer, or the work is happening on their servers with a copy of your session living there. Both are legitimate products. They are very different purchases, and the marketing language does not distinguish them. Perplexity says your laptop need not be open. Anthropic says Chrome must be open. Both statements are true about different architectures, and neither tells you which one you are buying.

So the first test does not ask the vendor. It asks the operating system.

The second test is there because agentic browsers are the first browsers designed to operate your logged-in accounts without you watching, which raises the cost of ordinary browser security failures. We picked the most basic check there is.

Test 1: the residency test

Method. Install the product. Launch it. Use it. Close it the way a person closes it, by closing the window, not by killing the process tree. Wait fifteen seconds. Then enumerate, from outside the application: every running process belonging to that vendor, every Windows service, every Windows Task Scheduler entry, every Run-key and Startup-folder entry, and every listening socket owned by a surviving process. Script: residency-probe.ps1.

How to read it. Nothing resident means no scheduled work can execute locally while the application is shut. It does not mean the vendor has no scheduler. It means the scheduler is somewhere else.

One line of nuance on our own row, because it is the row a hostile reader will check first. Aera installs that logon task on demand, the first time you rely on the service: when you save a scheduled task, when you turn the MCP endpoint on, or when you pair a phone. A fresh Aera install that has never been given a scheduled task leaves nothing resident either, and we observed exactly that. The difference the table is recording is that Aera has a place for the clock to live that is not inside the browser, and the other three do not. How that works is written up at /architecture.

Which of them actually ship a scheduler

Residency answers where work could run. It does not answer whether the feature exists. Separately, from the shipped binaries and from vendor documentation:

Put the two tables together and the useful distinction is not "scheduled or not". Four of the five schedule something. The distinction is whose machine the run happens on, and whose copy of your session it uses. That is the question to put to any vendor in this category, and it has a checkable answer.

Test 2: does it still check certificates

Method. Point each browser at four deliberately broken hosts on badssl.com: an expired certificate, a self-signed certificate, a certificate for the wrong hostname, and one signed by an untrusted root. Read back the page title and body text. A browser that validates certificates shows an interstitial and never renders the site's own content. Script: tls-probe.mjs.

Fellou loaded all four without an interstitial. The reason is visible in its own process list. Its network process runs with certificate errors ignored, and its renderers run with the sandbox off:

"C:\Program Files\Fellou\Fellou.exe" --type=utility
  --utility-sub-type=network.mojom.NetworkService
  --service-sandbox-type=none
  --ignore-certificate-errors --ignore-certificate-errors ...

"C:\Program Files\Fellou\Fellou.exe" --type=renderer
  --no-sandbox --no-zygote ...

What that costs the user: on any network they do not control, every site in that browser can be read and rewritten by whoever runs the network. In a browser sold on an agent that works across your logged-in accounts, the exposure is the account set, not one page.

Scope of this finding, stated precisely. This is Fellou 2.5.15, the Windows build installed on our test machine, binary dated 2025-10-28, tested 2026-08-06. The Fellou download page does not expose a version string we could read without running its JavaScript, so we cannot tell you whether the current release behaves the same. Separately, on the same morning, Fellou's agent endpoint agent.fellou.ai returned HTTP 502 both to the application and to a direct request.

What we could not test, and why

The value of a table like this comes entirely from being straight about its edges.

One more edge, on our own row. This report does not contain a measured unattended task run for any product, including Aera. What we measured is whether a scheduler can run locally, which is a structural property and settles the argument the category is actually having. Task success rates are a different study with a different method, and mixing the two is how vendor benchmarks get written.

The ten months behind this

The dates that changed the shape of the category, most recent first.

The security week

On 2026-08-05, Zenity Labs published the full scope of PleaseFix, a vulnerability class that lets a page or an email hijack a browser's built-in agent with no click and no approval from the user. The research was presented at Black Hat USA 2026 in a session titled "Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover" by Michael Bargury and Stav Cohen. Zero-click chains were demonstrated against Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Copilot Edge. Zenity states that vendors were notified ahead of the presentation, that some issued patches, and that others declined, describing the findings as intended functionality.

The mechanism is worth understanding rather than filing under "prompt injection". An agent reasoning over content from several origins inside one session breaks the assumption the whole web security model rests on, which is that code from one origin cannot act on another. In the Claude in Chrome chain, the researchers turned the agent's own JavaScript tool into a way to run attacker code on whatever site the agent was visiting, starting from one malicious email and an ordinary request to summarise the inbox.

We are not going to tell you Aera is immune. Aera ships an agent-callable JavaScript tool of the same shape as the one that chain abused. It has not been tested against this attack class. What we can point at is architecture rather than a claim: where the agent runs, what it is allowed to do without asking, and how the instruction hierarchy is written, all of which are described at /architecture and /security. Anybody in this category who responds to that research with a reassurance instead of a test should be asked for the test.

Three questions worth asking any vendor here

1. When my task runs and my browser is shut, whose computer is it running on? If the answer is theirs, ask where the copy of your session lives and who at the company can reach it.
2. What happens to a task that came due while my machine was off? Skipped, queued for next launch, or run in your absence. All three are defensible. Only one of them is what most people assume they bought.
3. What did you do about the agent-hijack research published in August 2026? A patch, a mitigation with a name, or a considered reason it does not apply. A reassurance is not an answer.

Method, in full

One machine: Windows 11, build 10.0.26200, x64. All products installed locally. Each Chromium-based product was launched with a dedicated user-data directory and driven over the DevTools protocol so that every navigation and every read is scripted rather than described. Fellou exposes a debugging port by default; the others were given one. Each quit was a window close, not a process kill, and each residency measurement was taken at least fifteen seconds afterwards. Certificate results are the raw page title and body text after navigation, with no human judgement in the loop.

Everything an external claim rests on carries a URL and the date we read it. Product versions are the versions we ran, not the versions currently advertised. Anything we did not run is in the limits table and is never in a results table.

Corrections are welcome and will be dated in place. If you are a vendor listed here and a row is wrong, tell us what to rerun and we will rerun it.

Appendix: raw output

Residency, after quitting Comet, Brave and Fellou, 2026-08-06 12:59 UTC. Unedited, with the unrelated third-party entries removed and nothing else changed.

== PROCESSES ==
  (no comet.exe, no brave.exe, no Fellou.exe)

== WINDOWS SERVICES ==
  brave                                       state=Stopped   start=Auto
  BraveElevationService                       state=Stopped   start=Manual
  CometElevationService                       state=Stopped   start=Manual
  CometUpdaterInternalService150.0.7871.230   state=Stopped   start=Auto
  CometUpdaterService150.0.7871.230           state=Stopped   start=Auto

== WINDOWS TASK SCHEDULER ==
  \AeraService  state=Running  triggers=[MSFT_TaskLogonTrigger]
                exec=aera_mcp_proxy.exe  lastRun=2026-08-06 07:43:51

== AUTOSTART (Run keys, Startup folder) ==
  (no Comet, Brave or Fellou entry)

Certificate validation, Fellou 2.5.15, 2026-08-06 12:55 UTC.

https://expired.badssl.com/
  title: expired.badssl.com
  text:  expired. badssl.com
  VERDICT: RENDERED THE BAD-CERT SITE (certificate validation is OFF)

https://self-signed.badssl.com/
  title: self-signed.badssl.com
  VERDICT: RENDERED THE BAD-CERT SITE (certificate validation is OFF)

https://wrong.host.badssl.com/
  title: wrong.host.badssl.com
  VERDICT: RENDERED THE BAD-CERT SITE (certificate validation is OFF)

https://untrusted-root.badssl.com/
  title: untrusted-root.badssl.com
  text:  untrusted-root. badssl.com The certificate for this site is signed
         using an untrusted root.
  VERDICT: RENDERED THE BAD-CERT SITE (certificate validation is OFF)

The same probe against the control browsers, same morning.

Brave 151.1.93.132        all four: title "Privacy error"  -> blocked
Perplexity Comet 150.0.7871.230  all four: title "Privacy error"  -> blocked
Aera 145.0.7596.132       all four: title "Privacy error"  -> blocked

Sources for everything we did not run

• Atlas shutdown and the move into ChatGPT: OpenAI help centre, read 2026-08-06.
• PleaseFix scope, affected products and vendor responses: Zenity Labs newsroom, press release dated 2026-08-05, read 2026-08-06. Coverage: Dark Reading.
• Perplexity scheduled tasks running in Perplexity's cloud: Perplexity help centre.
• BrowserOS scheduled tasks needing the browser open: docs.browseros.com, read 2026-07-31.
• Polar, macOS only, scheduled workflows, seed round: polarbrowser.com and TechCrunch, 2026-07-29.

Aera is a Chromium browser that runs your tasks on a schedule, on your own machine, in the sessions you are already signed into. The architecture is written up at /architecture, and what we do and do not do with your data is at /security.