Two of the earliest agentic browsers to reach the market didn't last. Fellou, one of the first agentic browsers the public could actually download, was already winding down by the time Arkose Labs' Threat Research Team disclosed a set of serious vulnerabilities; what development continued afterward lasted only a few more weeks. ChatGPT Atlas, OpenAI's own entry in the category, shut down entirely on August 9, less than a year after launch.
OpenAI hasn't explained the Atlas shutdown. But the pattern is instructive. Building a secure, widely adopted, standalone agentic browser has proven hard for everyone who's tried it so far.
Two Products, One Pattern
Fellou reached the market in the spring of 2025, months ahead of Perplexity's Comet in July and OpenAI's Atlas in October, but the head start didn't translate into staying power.
Earlier this year, under Arkose's standard 90-day responsible disclosure practice, Arkose Labs' Threat Research Team disclosed vulnerabilities in Fellou's autofill and password-manager implementation. We're not publishing the specifics, since Fellou is no longer available and thus there's no remediation path, but the vulnerabilities all sat in the same layer.
Every vulnerability was part of the basic, expected feature set of the browser: how a saved password gets matched to the page asking for it, how a payment vault decides how to present credit card details, whether a piece of page JavaScript can reach privileged parts of the app at all. None of it touched the agentic layer, the part that plans tasks and clicks around a page on the user's behalf.
Atlas' exit looked different on the surface. OpenAI launched it in October 2025, and on July 9, 2026, James Sun, who leads OpenAI's browsing efforts, confirmed as part of a broader product update that Atlas would stop working on August 9, folding its agentic capabilities into a rebuilt ChatGPT desktop browser, a cloud-hosted browser for the app's own agents and an updated Chrome extension. It didn't even get its own announcement; it was buried in a customer support article.
Why Building Your Own Browser Is Harder Than It Looks
Every general-purpose browser in daily use carries something like 15 years of accumulated engineering that's largely invisible to users: syncing bookmarks and history across devices, managing a password and payment vault safely, scoping autofill and cookies to the correct site, keeping up with security issues, maintaining a review pipeline for the extensions it lets onto a user's machine, running a bug bounty program that keeps finding what internal teams miss. None of that is agent-related, but all of it has to be built and continuously maintained by anyone shipping their own browser, rather than building on top of one that already exists.
Despite the maintenance costs, a custom browser has real strengths. By fully controlling the browser layer, a vendor can offer a first-class agentic experience that a Chrome extension can't: deeper integration with rendering and navigation, a UI built around the agent instead of bolted onto one, none of the permission friction or API ceilings an extension has to work within. A vendor that can manage the costs can offer a fully featured, well-thought-out user experience.
Fellou is Electron-based, so Chromium sits underneath it, but the extra layers that make a browser window into a usable browser, autofill, the password vault, the address book, are custom code layered on top, and that's the layer the Threat Research Team's disclosure was focused on. Atlas took a different approach: a heavily modified fork of Chrome with its own UI framework.
Either way, the underlying cost is the same: a browser isn't something you build once, it's something you maintain indefinitely, tracking upstream Chromium security patches, keeping your own modifications compatible with each new release, and carrying the ordinary cost of running a security program on top of all of it. That's a permanent line item, not a one-time build cost, and it doesn't shrink just because the differentiating feature is a first-class agentic experience.
What Adoption Looks Like So Far
Security aside, there's the adoption question. Standalone agentic browsers themselves have stayed a niche product, useful for specific workflows, but never approached mainstream browser-switching behavior. Part of Atlas' problem was that it never left macOS, and Fellou never had a chance of getting the brand recognition of ChatGPT.
That doesn't mean the underlying demand disappeared. Traffic from AI sources to US retail sites grew 393% year over year in the first quarter of 2026 alone, and by March it was converting better than it had a year earlier, according to Adobe Analytics. Real money is already moving through agents acting on behalf of real customers, so the demand isn't in question. The question is whether you need to build your own browser to capture it.
The next wave takes a different approach: rather than asking users to install a new browser, it works within the one they already have. OpenClaw demonstrated a similar approach, allowing the agent to connect directly to the user's browser when needed but to use its own otherwise. That's the shape OpenAI itself is now assembling post-Atlas, an updated Chrome extension alongside a rebuilt desktop app. Unlike a browsing surface built into the AI chat product itself, whether that's ChatGPT's or Claude's own in-app browsing, this approach meets the user where they are. Anthropic already shipped Claude for Chrome, a browser extension distinct from Claude's separate computer-use feature, that lets Claude read pages, click, type and move between tabs inside a user's own Chrome.
Arkose Labs sorts inbound agent traffic into three populations, not one undifferentiated mass, and Fellou and Atlas both sit in the middle one: legitimate, but never built to identify themselves. Standalone agentic browsers were always just one design for an agent, not the category's inevitable end.
The Detection Picture Changes Too
This shift matters for a reason beyond adoption. Fellou was built on top of Electron. Atlas was a heavily modified fork of Chrome with its own UI framework. Comet stays closer to stock Chrome but layers its agentic features in through an internal extension. These are all different approaches, but each changes how the browser behaves in small, visible ways relative to a genuine stock installation, leaking differences in behavior, rendering and browser internals. These mismatches are detectable even when the agent isn't actively being used on a given page.
The pattern now splits into two distinct cases. The first is the vision-reasoning-action loop that generic computer-use harnesses run when controlling a machine externally: take a screenshot, process it with a vision model to locate where to click, send that instruction, execute the click and repeat until the task ends. This loop creates timing and interaction patterns no human hand replicates, making it fingerprintable, because the pattern is inherent to how those models operate.
The second is a browser extension harness talking to Chrome's own debugging interface directly, which is what Claude for Chrome and Manus' browser extension both do. There's no screenshot loop and no vision model in that path; the extension attaches via the Chrome DevTools Protocol and drives the browser through the same protocol-level commands a developer would use to debug a page. It's real, unmodified Chrome the entire time, so the browser layer still gives away nothing. The signals are elsewhere, buried in how the UI is exposed to the user and how the extension interacts with the page.
It's a meaningfully different mechanism from a vision loop and is gaining traction. Anthropic and Manus have already shipped CDP-based extensions to consumers, while OpenAI currently has a developer-focused Codex extension that predates the Atlas news, and a general ChatGPT extension just announced as part of the wind-down, with no track record yet either way.
The failure of the standalone agentic browser doesn't make agentic traffic harder to find overall. It removes the easy task of spotting a browser that isn't really Chrome and leaves two harder tasks: spotting the vision loop and spotting the extension quietly communicating with Chrome's debugging protocol under a real Chrome browser.
Both are still visible to Agent Trust Manager. Fingerprint and telltale matching, the stage that compares a session against known agent frameworks and browsers, is where this pattern gets caught: it's built to run against exactly this kind of behavioral fingerprint, not just against a browser that fails to look like Chrome.
Why Detection Alone Isn't Enough
As agent traffic moves off distinct, customized software and into the browser your customers are already using, the question stops being whether this is really Chrome. Increasingly, it will be, and so will the agent running inside it, because the extension model works within a browser the user already has. The question that replaces it is whether the thing operating a legitimate user's Chrome browser is a human or an agent, and if it's an agent, what it's actually trying to do.
Answering that requires three things in sequence. First, visibility into the harness operating inside a real, unmodified browser session, since that's the only layer still carrying signal once the wrapper stops giving anything away. Second, classification: resolving each session by population, self-disclosing, non-disclosing or adversarial, and then into an intent, because an agent completing a legitimate purchase and an agent probing an account-recovery flow are not the same threat, even if they arrive through the same extension. Third, enforcement: acting on that classification with a graduated response, allow, monitor, challenge, throttle or block, re-evaluated continuously rather than settled once at login, so that a session's treatment can change as its behavior does.
That sequence is what Arkose Agent Trust Manager was built to run, regardless of which browser, extension or protocol the agent arrived through.
The specific wrapper an agent arrived in mattered while standalone agentic browsers were still a live option, since it gave defenders an easy tell to lean on. It matters a lot less now that the winning shape looks like a real browser with something else quietly driving it. Whatever specifically sank Fellou and Atlas individually, the pattern is consistent: building and securing an entire browser was always the smaller problem. Seeing, classifying and responding to what's actually running inside one is the harder problem, and it doesn't go away no matter which browser wins.
This is the first of two posts on how agentic browsing is actually shaped today. The next one looks at how personal AI agents and agentic browser extensions differ in the way they interact with a web page, and which of the two bothers to hide.
