Staufer mentions there aren’t any clear rules yet about how AI agents should act online. Most of these agents don’t openly say they’re AI to users or third parties by default.**** Only three agents have watermarking features to mark generated content as AI-made.
At least six AI agents listed in the Index use code and IP tricks that mimic human browsing to get past anti-bot systems.
“Website owners can’t really tell if a visitor is a person, a genuine agent, or just a bot scraping info,” said Staufer. “This affects everything from online shopping and filling out forms to booking stuff and data scraping.”
The latest update includes a case study on Perplexity Comet – one of the most independent browser-based AI agents in the Index but also one of the riskiest and least open about what it does.
Comet is advertised as working “just like a human assistant.” Amazon has even threatened legal action because Comet doesn’t identify itself as an AI when it uses Amazon’s services.
“If safety warnings aren’t clear, issues might only pop up once someone exploits them,” said Staufer.
“For example, browser agents can actually take actions like making purchases, filling forms, or logging into accounts. So any security flaw could have quick and serious effects.”
Staufer points out that last year security experts found malicious webpage content could hijack browser agents into doing things they weren’t supposed to do, while other attacks managed to steal private user info from linked services.
Staufer added: “The newest AI Agent Index shows how fast these tools are rolling out compared to how slowly safety checks are happening. Most developers don’t share much about safety measures or social impacts.”
“AI agents keep getting smarter and more able to act in the real world, but rules and transparency haven’t kept up – which is pretty risky.”
* In the Index, only Chat GPT Agent, Open AI Codex, Claude Code, and Gemini 2.5 Computer Use have system cards specific to their agent – though some Chinese ones have research papers about computer-use functions.
** Many browser agents work at levels 4-5 on the “five levels of escalating agent autonomy” scale (Level 4 means user approval needed; Level 5 means user just watches).
*** Safety fields used by researchers include things like guardrails; sandboxing (running an AI inside a controlled setting); risk assessments; safety tests; third-party reviews; benchmarks; bug bounties (crowdsourced security checks); records of known incidents.
**** 21 out of 30 agents listed show no default disclosure behaviour documented at all.
Here’s the full list of institutions involved with the AI Agent Index:
The University of Cambridge (UK), University of Washington (US), Harvard Law School (US), Stanford University (US), Concordia AI (China), University of Pennsylvania (US), Massachusetts Institute of Technology (US), Hebrew University of Jerusalem (Israel).
