I Let Google’s ‘Auto Browse’ AI Agent Take Over Chrome. It Didn’t Quite Click

When I was finally able to experiment with Auto Browse (for real this time), I took Google’s suggestions of digital chores as my starting point and picked online tasks that could be helpful in my own life.

Whenever interacting with generative AI tools, a healthy sense of skepticism—and caution—is critical. Google even includes a disclaimer baked into its Gemini chatbot reminding users that it makes mistakes. The Auto Browse tool goes a step further. “Use Gemini carefully and take control if needed,” reads persistent text that shows in the chatbot sidebar every time Auto Browse is running. “You are responsible for Gemini’s actions during tasks.”

Before you try it out, you also need to think about the security risks associated with this kind of automation. Generative AI tools are vulnerable to being compromised through prompt injection attacks on malicious websites. These attacks attempt to divert the bot from its task. The potential vulnerabilities in Google’s Auto Browse have not been fully examined by outside researchers, but the risks may be similar to other AI tools that take control of your computer.

In addition, take extra caution if you’re using Auto Browse to make purchases. Google has safeguards in place that flag certain actions, like buying stuff or posting on social media, as sensitive and in need of user approval to continue. Still, I was unsure how the bot would behave and anxious about the havoc it could potentially wreak with my credit card, to say nothing of handing over financial info to it in the first place.

Here’s the first prompt I sent it, card in hand:

I want to book two tickets to the SF symphony tonight. I don’t want to pay for orchestra seating, but the tickets don’t need to be the cheapest ones available. Please pick the two seats next to an aisle.

It’s a bit bizarre to watch Google’s AI agent click around in the tab. First, I saw it use Gemini 3, Google’s latest model, to strategize and define goals, like getting two aisle seats at the symphony, in the sidebar text box for a few seconds. This process looks similar to a chatbot using a “reasoning” model, talking through the steps it might take before moving forward. Then, the clicking starts. Each step the bot takes as part of a task is logged for users.

Auto Browse’s ability to perform multistep tasks without getting sidetracked was noticeably better than similar agent tools that I tested last year. It navigated to the correct website, chose the right performance, and clicked on multiple seat sections to gauge availability. Everything listed in the log appeared to be what it actually executed.

After a couple of minutes of working on the symphony tickets, the bot stopped clicking. I received a notification to take over and press the Order Now button. At a glance, the AI tool had seemingly delivered what I’d asked for, and rather quickly.

But if I had unquestioningly ordered the two seats Auto Browse chose for a date at the symphony, the night would most likely have ended with my boyfriend making me sleep on the couch.