The privacy-minded corner of the internet is awash in the shock waves generated by the latest Mozilla press release: Firefox, the long-time refuge for those who demand control and a tracker’s least favorite website, will become an AI browser over the next three years. The newly appointed Mozilla CEO, Anthony Enzor-DeMeo, promises it’s a change that will be on the user’s terms. “Every product we build must give people agency in how it works. Privacy, data use, and AI must be clear and understandable,” he says. “AI should always be a choice something people can easily turn off.”
The offer of these optional AI functionalities has had little effect in soothing the tempest. Social media was filled with comments that strongly condemned Mozilla for going back on its basic supporters. A typical comment posted said, “This is a good example of how management doesn’t understand its own user base,” while another bluntly stated, “I’ve never seen a company so astoundingly out of touch with the people who want to use its software.” Many Firefox supporters had chosen to use the browser precisely because its direction was different from the likes of Edge, Chrome, Opera, and Brave, who all place a significantly heavier emphasis on AI.
Technologically speaking, AI browsers are very different from the traditional browsers we are used to. These browsers directly integrate massive language models into browsing activities such as webpage summarization, contextual search, and “agentic” task completion without human intervention. Such models may involve the analysis of every observable content of webpages, including images and scripts and cross-referencing them with the browsing history of the user. In other designs like OpenAI’s Atlas browser, “browser memories” are optional and are used to make predictions based on the observations of what a webpage might have offered in the past.
The privacy implications are far-reaching. A 2025 USENIX survey found that the most commonly used AI browser extensions were logging sensitive information such as medical and banking records and sending this information to third-party servers. More privacy-focused AI browser extensions like the ones developed by the company Perplexity from the US also need access to the URLs or the browser path associated with visited websites, cookies for previously visited websites with sensitive login credentials, and download history. This is problematic for users with an emphasis on Firefox’s Total Cookie Protection and Enhanced Tracking Protection.
Another area of contention is the issue of security. The threat of prompt injection attacks makes AI-powered browsers vulnerable to having the AI’s operations hijacked by malicious instructions encoded in webpage markup. Gartner has issued a warning to the chief information security officers of organizations to “block all AI browsers in the foreseeable future” because of the attendant risks. The National Cyber Security Centre in the UK compares the issue of prompt injection to SQL injection vulnerabilities, which might never be mitigated. This means that the attacked AI browser might independently browse sensitive sites, steal credentials, and send them to the attackers.
The fact that Mozilla insists that the use of AI in their browser will be an “option” is a nod to Microsoft’s recent about-face regarding their “agentic OS” plans in Windows, in the face of public outcry. However, this doesn’t entirely solve the concern regarding the mere existence of AI code in a browser, since even if it’s optional, it could still increase the browser’s attack surface, and it’s a fact that optional software tends to be difficult to avoid in the long run. They cite how Edge & OneDrive are so tightly integrated into Windows 11.
It is clear that this is only the tip of the iceberg because AI browsers are anticipated to generate revenue of $750 billion by 2028. It is stated that this is being done because companies are eager to develop LLM capabilities before their competitors do. The competitors are working on the idea of privacy-focused AI browsers like Brave’s model processing on device rather than cloud-based analysis. But because of the open-source nature of the Firefox web browser and its ability to stand against invasive tracking practices in the past, its ability to apply AI is not entirely barred yet.
Privacy-minded users have continued to turn to alternative browsers. LibreWolf removes all telemetry code from Mozilla Firefox, Mullvad Browser provides a level of VPN-based anonymous routing coupled with DAITA defenses against AI-based traffic analysis, and Tor routes traffic through a series of encrypted points to render tracking impossible. None of these specialized browsers have the ‘˜polish’ that comes with using Mozilla Firefox but are deeply in line with the ethos now endangered in Mozilla’s push to embrace AI.
As browser wars escalate into an age of AI, it’s not just convenience that’s on the line. From a technical perspective, embedding AI into an existing browser significantly alters its user relationship dynamics from a passive to an active observer and participant. For many loyal Firefox fans, it simply represents a breakdown of a relationship that originally retained their loyal patronage to begin with.
