CURRENT | Market Pulse

The Control Layer

The Browser Was Never Neutral. Now Something Is Testing the Terms.

By Nora Kaplan— March 4, 2026

Feature image for article: The Browser Was Never Neutral. Now Something Is Testing the Terms.

On August 19, 2025, Amazon blocked Perplexity's browser from its marketplace. Within twenty-four hours, Perplexity shipped a workaround. Amazon blocked again. By November, they were in federal court. That escalation happened fast enough to tell you something about the stakes.

For over a decade, two incumbents have held roughly 85% of the browser market, and the commercial web settled into a remarkably stable deal around that dominance. Users got content; platforms got attention, data, ad impressions. Now a wave of new browsers has arrived, all built on the same premise. The entity doing the browsing doesn't have to be human. The deal never accounted for that.

The Control Layer

The Browser Was Never Neutral. Now Something Is Testing the Terms.

On August 19, 2025, Amazon blocked Perplexity's browser from its marketplace. Within twenty-four hours, Perplexity shipped a workaround. Amazon blocked again. By November, they were in federal court. That escalation happened fast enough to tell you something about the stakes.

For over a decade, two incumbents have held roughly 85% of the browser market, and the commercial web settled into a remarkably stable deal around that dominance. Users got content; platforms got attention, data, ad impressions. Now a wave of new browsers has arrived, all built on the same premise. The entity doing the browsing doesn't have to be human. The deal never accounted for that.

Nora Kaplan

Nora Kaplan, former collaboration platform product leader turned technology writer. Studied human-computer interaction and spent years designing tools for knowledge work. Now writes about AI agents, work transformation, and how enterprise software reshapes human capability at TinyFish.

The Field

For the better part of a decade, the browser was furniture. Chrome dominated, Safari held mobile, and nobody thought much about it. That quiet is over.

AI-native browsers are arriving from startups and major labs simultaneously, each wagering that browsing itself is about to become a different kind of activity. The incumbents controlling the vast majority of global traffic are responding. And the first serious legal fight over what an autonomous agent can actually do on the open web is already in court.

Here's who's building, who's defending, and where friction is already visible.

The Field

For the better part of a decade, the browser was furniture. Chrome dominated, Safari held mobile, and nobody thought much about it. That quiet is over.

AI-native browsers are arriving from startups and major labs simultaneously, each wagering that browsing itself is about to become a different kind of activity. The incumbents controlling the vast majority of global traffic are responding. And the first serious legal fight over what an autonomous agent can actually do on the open web is already in court.

Here's who's building, who's defending, and where friction is already visible.

New Entrant

Perplexity Comet Brings Agentic Browsing to iOS

Chromium-based AI browser, free worldwide since October 2025. iOS launch scheduled March 11, 2026. Runs Claude Sonnet 4.6 for Pro subscribers, Opus 4.6 for Max. Handles full browsing workflows autonomously, turning web sessions into conversational interactions where the agent clicks, scrolls, and transacts on the user's behalf.

New Entrant

Dia Gets Enterprise Backing via Atlassian Acquisition

The Browser Company shelved its power-user Arc browser to build Dia, a Chromium-based AI browser aimed at everyday workflows. Atlassian acquired the company for a reported $610M, folding Dia into its knowledge-worker ecosystem with planned enterprise integrations.

New Entrant

Opera Neon Runs Agents Locally, Eyes Europe

Publicly traded Opera opened Neon access in December 2025. Its "Neon Do" function operates within user sessions locally rather than routing through the cloud. A February 2026 update added automatic agent selection. European server infrastructure gives it a pitch to GDPR-conscious markets.

New Entrant

OpenAI Building a Browser Around Operator Integration

OpenAI is developing a Chromium-based browser to embed its Operator web agent directly into browsing, per Reuters. Built by former Google Chrome engineers. Referred to publicly as ChatGPT Atlas. With 500 million weekly ChatGPT users, the potential install base is already enormous.

Market Incumbents

Chrome and Safari Still Own the Traffic

Google and Apple together hold roughly 83–85% of global browser traffic, per StatCounter. Google shipped Chrome Auto Browse in January 2026, adding agentic capability inside the dominant browser rather than yielding the layer. Apple has made no comparable announcement.

Legal Friction

Amazon Sues Perplexity Over Comet's Shopping Automation

Filed November 4, 2025 in San Francisco federal court. Amazon alleges Comet disguises itself as Chrome, makes purchases without disclosing bot activity, and evaded Amazon's technical barriers. Perplexity argues user agents carry the user's own permissions. The outcome could set platform access rules for autonomous agents broadly.

Research Context

Principal-Agent Dynamics and Digital Platform Economics in the Age of Agentic AI

Uses principal-agent theory to map how autonomous agents destabilize two-sided platform economics. When agents act on behalf of users, they bypass ads, recommendations, and the attention-capture mechanisms platforms rely on to monetize both sides.

So who loses first?

Agents acting for users hollow out attention-based business models, shifting bargaining power away from platforms that control the interface.

Does disruption actually disrupt?

Agent-to-agent commerce could trigger an arms race that favors resource-rich incumbents, reinforcing existing power structures rather than leveling them.

Amazon.com Services v. Perplexity AI — Federal Complaint (N.D. Cal., November 2025)

The first federal lawsuit squarely targeting a browser agent's autonomous behavior on a third-party platform. Amazon alleges Perplexity's agent concealed its identity and evaded technical barriers to transact on users' behalf, framing this as computer fraud and contract violation.

How has the legal terrain shifted?

Agent identity disclosure and fingerprint evasion are the central fault lines here, moving well beyond the hiQ v. LinkedIn scraping precedent.

Where does enforcement actually bite?

Terms of service, not the CFAA, emerge as the primary lever, making platform consent a contract question rather than a criminal one.

Fine-Tuning Aligned Language Models Compromises Safety, Even When You Don't Intend It To

Princeton and Stanford researchers showed that fine-tuning reliably degrades safety alignment, even with benign data. Adversarial fine-tuning on just 10 examples bypassed guardrails at under $0.20. Peer-reviewed at ICLR 2024, with findings replicated independently across model families.

How cheap is the bypass?

Ten examples and twenty cents. That cost profile makes model-layer safety controls structurally inadequate as a standalone defense for production agents.

What fills the gap?

If guardrails degrade under routine fine-tuning, action-layer controls at the browser become a structural necessity, not an optional hardening step.

WebVoyager Browser Agent Benchmark Leaderboard (February 2026)

The standard browser agent benchmark now shows top performers completing 87–97% of web tasks across 643 scenarios. But benchmark conditions exclude bot detection, CAPTCHAs, and fingerprinting, so production success rates on defended sites are materially lower.

Capable enough to matter?

Browser agents reliably handle most standard web tasks in controlled settings, making the tension between capability and platform consent operationally real.

Where does the gap live?

Production sites with anti-bot infrastructure block unidentified agents. The space between benchmark and deployment is exactly where the control-layer question sits.

Research Context

Principal-Agent Dynamics and Digital Platform Economics in the Age of Agentic AI

Uses principal-agent theory to map how autonomous agents destabilize two-sided platform economics. When agents act on behalf of users, they bypass ads, recommendations, and the attention-capture mechanisms platforms rely on to monetize both sides.

So who loses first?

Agents acting for users hollow out attention-based business models, shifting bargaining power away from platforms that control the interface.

Does disruption actually disrupt?

Agent-to-agent commerce could trigger an arms race that favors resource-rich incumbents, reinforcing existing power structures rather than leveling them.

Research Context

Amazon.com Services v. Perplexity AI — Federal Complaint (N.D. Cal., November 2025)

The first federal lawsuit squarely targeting a browser agent's autonomous behavior on a third-party platform. Amazon alleges Perplexity's agent concealed its identity and evaded technical barriers to transact on users' behalf, framing this as computer fraud and contract violation.

How has the legal terrain shifted?

Agent identity disclosure and fingerprint evasion are the central fault lines here, moving well beyond the hiQ v. LinkedIn scraping precedent.

Where does enforcement actually bite?

Terms of service, not the CFAA, emerge as the primary lever, making platform consent a contract question rather than a criminal one.

Research Context

Fine-Tuning Aligned Language Models Compromises Safety, Even When You Don't Intend It To

Princeton and Stanford researchers showed that fine-tuning reliably degrades safety alignment, even with benign data. Adversarial fine-tuning on just 10 examples bypassed guardrails at under $0.20. Peer-reviewed at ICLR 2024, with findings replicated independently across model families.

How cheap is the bypass?

Ten examples and twenty cents. That cost profile makes model-layer safety controls structurally inadequate as a standalone defense for production agents.

What fills the gap?

If guardrails degrade under routine fine-tuning, action-layer controls at the browser become a structural necessity, not an optional hardening step.

Research Context

WebVoyager Browser Agent Benchmark Leaderboard (February 2026)

The standard browser agent benchmark now shows top performers completing 87–97% of web tasks across 643 scenarios. But benchmark conditions exclude bot detection, CAPTCHAs, and fingerprinting, so production success rates on defended sites are materially lower.

Capable enough to matter?

Browser agents reliably handle most standard web tasks in controlled settings, making the tension between capability and platform consent operationally real.

Where does the gap live?

Production sites with anti-bot infrastructure block unidentified agents. The space between benchmark and deployment is exactly where the control-layer question sits.

Legal Flashpoint

Amazon's Lawsuit Against Perplexity Frames Agent Browsing as Computer Fraud

"Undisclosed bot activity that masquerades as human clicks." That phrase, buried in Amazon's November 2025 complaint, deserves more attention than the lawsuit itself. Amazon alleges Perplexity's Comet browser spoofed standard Chrome user-agent strings to pass automated browsing off as human activity, then updated its evasion techniques within 24 hours of new detection measures going live.

The CFAA theory here is narrow and potent: the violation isn't accessing Amazon. It's accessing Amazon without saying you're an agent.

If courts accept that framing, every agentic browser operating on commercial platforms without explicit identity disclosure is carrying compliance risk. Jones Walker's analysis puts this in context: the case arrives just as NIST finalizes identity and authorization standards for autonomous agents. The simplest possible form of agent transparency, announcing what you are, became the legal fault line.

Legal Flashpoint

Amazon's Lawsuit Against Perplexity Frames Agent Browsing as Computer Fraud

Undisclosed bot activity that masquerades as human clicks." That phrase, buried in Amazon's November 2025 complaint, deserves more attention than the lawsuit itself. Amazon alleges Perplexity's Comet browser spoofed standard Chrome user-agent strings to pass automated browsing off as human activity, then updated its evasion techniques within 24 hours of new detection measures going live.

The CFAA theory here is narrow and potent: the violation isn't accessing Amazon. It's accessing Amazon without saying you're an agent.

If courts accept that framing, every agentic browser operating on commercial platforms without explicit identity disclosure is carrying compliance risk. Jones Walker's analysis puts this in context: the case arrives just as NIST finalizes identity and authorization standards for autonomous agents. The simplest possible form of agent transparency, announcing what you are, became the legal fault line.

Active evasion:

Amazon claims Perplexity updated Comet to dodge newly deployed detection fingerprints within 24 hours, escalating passive non-disclosure into deliberate circumvention

Regulatory timing:

NIST's RFI on AI agent security closed March 9, with an identity and authorization concept paper due April 2

Parallel claims:

Reddit filed a similar federal suit in October 2025 alleging Perplexity masked bot identities and bypassed access controls to scrape content

Legal gap:

No U.S. statute currently mandates AI agent identity disclosure; Amazon is enforcing through contractual terms of service, not legislation

Security exposure:

Researchers demonstrated "CometJacking," a prompt injection attack exfiltrating Gmail and calendar data through the agentic browser via a single URL