I Allowed Google’s ‘Auto Browse’ AI to Control Chrome, but It Didn’t Quite Work Out.

When I finally got the chance to test Auto Browse for real, I used Google’s recommended digital tasks as my base and selected online activities that could be beneficial in my daily life.

A healthy dose of skepticism and caution is essential when engaging with generative AI tools. Google even adds a disclaimer in its Gemini chatbot, reminding users that mistakes can happen. The Auto Browse tool takes this further: “Use Gemini cautiously and take control if necessary,” a persistent message in the chatbot sidebar alerts every time Auto Browse is active. “You are accountable for Gemini’s actions during tasks.”

Before diving in, it’s important to consider the security risks that come with this type of automation. Generative AI tools can be susceptible to prompt injection attacks from malicious websites, which aim to mislead the bot from its intended actions. While the potential vulnerabilities in Google’s Auto Browse haven’t been thoroughly evaluated by external researchers, they may share similar risks with other AI tools that manage your computer.

Moreover, exercise extra caution if you’re utilizing Auto Browse for purchases. Google has implemented safeguards to flag specific actions, such as buying items or posting on social media, as sensitive and requiring user approval to proceed. However, I felt uncertain about how the bot would operate and was apprehensive about the potential disruptions it could cause with my credit card, not to mention the implications of sharing my financial information.

Here’s the first instruction I sent it, card at the ready:

I want to book two tickets to the SF symphony tonight. I don’t want to pay for orchestra seating, but the tickets don’t need to be the cheapest ones available. Please choose two seats next to an aisle.

Watching Google’s AI agent navigate the tab was a bit peculiar. Initially, I observed it utilizing Gemini 3, Google’s newest model, to strategize and set goals, like securing two aisle seats at the symphony, in the sidebar text box for a few seconds. This process resembles a chatbot employing a “reasoning” model, articulating the steps it might take before proceeding. Then the clicking commenced. Each action the bot takes as part of a task is recorded for users.

Auto Browse’s capability to execute multistep tasks without losing focus was noticeably superior to comparable agent tools I tested last year. It successfully navigated to the right website, selected the appropriate performance, and clicked on various seat sections to check availability. Everything recorded in the log seemed to accurately reflect its actions.

After a few minutes of working on the symphony tickets, the bot paused its clicking. I received an alert to take over and click the Order Now button. At first glance, the AI tool appeared to have delivered exactly what I requested, and quite swiftly.

However, had I blindly ordered the two seats that Auto Browse selected for the symphony, my evening would likely have ended with my boyfriend insisting I sleep on the couch.