OpenAI ships Atlas, a browser where ChatGPT reads and clicks the DOM

What OpenAI actually shipped on macOS

ChatGPT Atlas is a standalone web browser, released October 21, 2025 for macOS to Free, Plus, Pro, and Go users, with Windows, iOS, and Android listed as coming soon. On first launch you sign into ChatGPT and import bookmarks, saved passwords, and browsing history from your existing browser.

The frontend of the browser itself is reorganized around the model. The new tab page accepts either a question or a URL, and returns chat results alongside tabs for search links, images, videos, and news. An Ask ChatGPT sidebar can see the page you are on. And agent mode — in preview for Plus, Pro, and Business — will, with your permission, start opening tabs and clicking inside your own browser to complete a task.

That last capability is the shift worth reading closely. The assistant is no longer a panel you copy text into. It is a second operator inside the same rendered page you are looking at.

The address bar becomes a permission surface

Because the assistant can read what the browser renders, OpenAI put visibility controls where the page is. A toggle in the address bar decides whether ChatGPT can see the current page at all: when visibility is off, it can't view page content and creates no memories from it.

The rest of the control model is explicit about what the agent cannot touch. Per the announcement, agent mode cannot run code in the browser, download files, or install extensions, and cannot access other apps or the file system. It pauses on sensitive sites such as financial institutions, and can be run in a logged-out mode to limit access.

OpenAI is also candid that these limits are not a full defense. The source states plainly that agents are susceptible to hidden malicious instructions planted in a webpage or email, which could lead to stealing data from sites you're logged into or taking actions you didn't intend — and that its safeguards 'will not stop every attack.' For anyone shipping a web frontend, that means your page content is now a potential injection vector against a user's agent, not just a display for a human.

One line about ARIA tags is the real message to frontend teams

Buried in the roadmap section is the detail that matters most to people who build interfaces. The announcement says website owners can add ARIA tags to improve how ChatGPT agent works for their websites in Atlas, and that Apps SDK developers will get ways to increase discoverability of their apps inside the browser.

Website owners can also add ARIA tags to improve how ChatGPT agent works for their websites in Atlas.Montana Labs

ARIA attributes were designed for assistive technology — screen readers navigating for people. Atlas repurposes that same semantic layer as the interface an automated agent uses to find buttons, forms, and fields it needs to click. The accessibility tree, long treated as optional polish, becomes the machine-readable contract between your frontend and an agent trying to complete a checkout or fill a form on a user's behalf.

That reframes accessibility work from a compliance line item into functional infrastructure. A grocery cart the agent is asked to fill, or a booking flow it's told to complete, will work more reliably on a page with correct roles and labels than on one held together by unlabeled div soup.

What Atlas means when your users arrive with an agent

The concrete implication is that a frontend now has two audiences reading the same DOM: a person and, increasingly, an agent acting for that person. OpenAI frames Atlas as 'a step toward a future where most web use happens through agentic systems.' Whether or not that scale arrives, the near-term reality is a shipping browser whose agent parses your markup to take actions.

Two practical consequences follow directly from the text. First, semantic HTML and ARIA labeling now affect task success, not just screen-reader users — the same structure that helps assistive tech helps the agent click the right thing. Second, because the source acknowledges page content can carry hidden instructions that hijack the agent, the page you serve is part of your users' security surface. Building a frontend for Atlas means writing markup an agent can trust to navigate, on a page you can vouch for.