Risk review
What an AI browser can leak, and how to check before you install one.
An agent reads pages and acts on them, so the risk is not only what the company stores. It is also what the page says to the agent, and what has to leave the phone for the agent to click. Here are the four places to look, and where Peji stands on each one.
Four places to look
Most reviews of AI browsers compare features. The privacy question is narrower and answerable: what leaves the phone, where the agent runs, what the page can say to the agent, and what the agent can do without asking. Each has a check you can run on any app before you trust it with a signed-in session.
| Question | Why it matters | How to check |
|---|---|---|
| Where do the prompts and the answers end up? | Chat text tends to carry more than a search query: an address, an invoice, a medical detail. | The privacy label on the App Store, then the privacy policy for retention and who processes the request. |
| Where does the agent run? | An agent that acts in the app uses the session on your phone; one that acts in the cloud sends the session with it. | Ask the agent a task that needs a login and read the explanation the app shows before it starts. |
| What can a web page say to the agent? | Page text reaches the model, and page text can contain instructions. | Look for a confirmation before any action that leaves a trace: send, buy, book, pay, publish, delete. |
| What does the agent do without asking? | Reading is recoverable. Sending is not. | Read the list of tools and find the line that describes the gate. |
A page can give the agent orders
Prompt injection is the name for text on a page that is addressed to the model rather than to you: a comment that says to ignore the previous instructions, a hidden line that asks for the contents of the mailbox, a listing whose description asks the agent to send money somewhere. The model cannot reliably tell a page's own words from the words of whoever wrote the page.
No browser removes the risk, Peji included. What reduces the damage is the shape of the run. The agent has a short list of tools, a page it read is not a user instruction, and every action that sends, buys, books, pays, publishes or deletes stops and waits for your answer. A page can still mislead a read. It cannot spend your money while you are not looking.
- Read: what the agent does most of the time, and what a page can influence.
- Ask: the gate. The run pauses, the confirmation names the action, and nothing happens without you.
- Refuse: you can stop a run at any step and continue it later.
The cloud agent, and the cookies it needs
Some agents do not click on your phone. They open a browser in a data centre and drive that one, because a machine there can run longer and reach pages that a phone session would interrupt. To act as you on a site where you are signed in, the agent needs your session, which means cookies leave the device.
Comet on iPhone works this way: its own prompt, in the version we read on 30 October 2026, says the request goes to a virtual cloud browser and that relevant cookies are transferred to the agent and deleted when the task is done. MacStories described the same mechanism in March 2026. The cookies are temporary. The session is not yours alone for the length of the task, and the pages the cloud machine opens are opened from an address that is not your phone.
That is a trade, not a scandal: a cloud agent can do things a phone cannot. What matters is knowing which one you are using before you point it at a mailbox, a bank or a shop with a card on file.
What leaves the phone on Peji
Peji runs the agent in the WebKit tabs on the iPhone, so the clicking happens on the device and the cookies stay there. What travels is the text the model needs to answer: your message, the page text the agent read, the images it looked at, the files it opened.
With the built-in provider that request passes through the Peji server, which counts usage and forwards it. The server writes no message, page, image or answer to its database and no log line carries the request body; text goes to inference.net and pictures to Runware, both with zero data retention on our accounts. With your own endpoint the Peji server receives nothing at all.
The honest limit: Peji is not an on-device model. The page text still reaches a model on a server, and a page can still try to steer what the agent does next. What stays on the phone is the browsing session, the chats and the files.
What to ask any AI browser
- Does the agent run on the phone or in the cloud, and does it say so before the run starts?
- Does a send, a purchase or a delete wait for you, or does it happen and get reported after?
- Is the session that the agent uses the one already on the phone, or a copy that travelled?
- How long does the provider keep a request, and is that written in a policy or a setting?
A short checklist before you sign in
Install the browser, open a site where you are not signed in, and ask for a task that clicks something harmless. Watch where the work happens and what the app tells you. Then read the privacy label. Signing in is the step that turns a browsing session into something worth stealing, and it should be the last step, not the first.
- A confirmation appears before a form is submitted.
- The run shows each step while it happens, not only at the end.
- The privacy label and the policy agree on retention.
- There is a way to use the browser with no account at all.
- There is a way to stop a run and keep the tabs open.
Questions
Are AI browsers a security risk?
They add one risk that a plain browser does not have: a page can address the agent, and the agent has tools. The risk is not the chat panel, it is an agent that acts without a confirmation. A browser that stops before a send, a purchase or a delete limits the damage a page can do to what you approve.
Do AI browsers send my cookies to a server?
Some do. An agent that runs in the cloud needs the session of the site it acts on, so it receives the relevant cookies for the length of the task. Comet on iPhone says it transfers them and deletes them when the task ends. An agent that runs in the app on the phone has no reason to send them.
Can a web page make the agent do something I did not ask?
It can try. Text on a page reaches the model, and a model cannot always separate a page's instructions from yours. The defence is a confirmation before any action that leaves a trace, plus a tool list short enough to read.
Is Peji an on-device AI browser?
No. The browser, the tabs, the chats and the dictation are on the iPhone; the model is remote. Saying otherwise would be the easiest lie on this page, so the page says it twice.
What does Peji keep on its server?
The account, hashed sessions and codes, daily usage counters and the subscription status. Not the message text, not the pages, not the images, not the cookies. With your own endpoint the server is not involved at all.
Where these facts come from
Read on 2026-10-30. Prices and labels change; the link is the document that counts.
- MacStories, Comet Is the First Agentic Browser for iOS Worth Tryinghttps://www.macstories.net/news/comet-is-the-first-agentic-browser-for-ios-worth-trying/
- Comet on the App Store, privacy label and version 26.40.0https://apps.apple.com/us/app/comet-ai-browser-assistant/id6748622471
- Peji, where each piece of data liveshttps://peji.si/private-ai-browser
- Wikipedia, prompt injectionhttps://en.wikipedia.org/wiki/Prompt_injection