How Far Can AI Automate Browser Tasks? The Reality of Form Filling, Booking, and Research
"I asked an AI and it opened the browser, looked things up, and even filled out a form." In 2026 this is no longer a staged demo: agentic browsers (ChatGPT Atlas, Claude for Chrome, Gemini/Chrome, Perplexity Comet) arrived all at once. So how far can they actually automate? The reality splits cleanly into three tiers. (1) Research = production-ready: on WebVoyager (real sites) top agents hit 89-98%, near-saturation, and since a wrong action costs little this is where to start delegating. (2) Form filling = doable but verify: the input itself is supported, yet agents can mislabel fields or hit the wrong submit, so "AI drafts, a human sends" is safe, and many products like Atlas ask for confirmation before important actions. (3) Booking/payment = still do it yourself: agents stumble on CAPTCHAs, complex JavaScript checkouts, two-factor auth and session management, and on WebArena (complex multi-step tasks) even the best score ~47-68% versus a ~78% human baseline; the very reason OpenAI shuttered standalone Operator (2025/8/31) was checkout unreliability. The article first frames the two approaches (consumer browser/extension vs developer API/OSS), then maps the 2026 players (Atlas as a dedicated browser that cannot run code or read passwords by design; Claude for Chrome as an extension side panel; Google's Project Mariner ended 2026/5/4 and folded into Gemini/Chrome; Operator moved into ChatGPT Agent and the Agents SDK; OSS browser-use at 78k+ stars). It explains the four walls that make booking fail (bot defenses, complex checkout, 2FA, the cost of undoing), then digs into the biggest pitfall: indirect prompt injection (Perplexity Comet was shown vulnerable to zero-click credential theft and fixed it in February 2026; attack success of 23.6% before defenses drops to ~11% with basic and ~1% with the strongest, still non-zero). It closes with five safety principles (start read-only, a human approves sends/payments, never hand over passwords, don't run on untrusted sites, least privilege in a dedicated profile). An excellent research partner; do the money-moving actions yourself. Figures are quoted from public materials and announcements as directional references.