Polar is betting that the next workplace browser will do more than display web apps: It will act inside them. On July 29, 2026, the company detailed its AI browser and announced a $5.7 million seed round led by Madrona after replacing its earlier Composer agent with Polar in May.
The macOS-only, Chromium-based browser uses AI agents to complete multistep tasks inside websites where a user is already signed in. The approach could reduce manual handoffs and the need to build a separate integration for every service, but it also gives IT teams new questions about permissions, data handling and oversight.
CEO Kevin Jiang previously worked on Perplexity’s Comet browser. He told TechCrunch that Polar targets recurring knowledge-work tasks rather than occasional consumer activities such as booking travel. The product arrives as AI agent permissions expose gaps in security systems designed primarily around human users.
Polar automates work across logged-in accounts
Polar can click, type and navigate websites through existing browser sessions. It can schedule jobs and use the current page or selected tabs as context, allowing work to continue across several sites without dedicated connectors.
In its July 29 announcement, Polar said users initiated more than 4.5 million web actions during seven months of testing. Some tasks reportedly ran for more than 15 hours. Those figures have not been independently verified.
Polar says users can observe an agent, take control at any time and keep sensitive decisions in human hands. It also says guardrails are designed to prevent agents from independently completing high-risk actions. Detailed documentation of those controls remains limited, and SOC 2 compliance is still in progress.
Polar’s privacy policy says browser history, bookmarks, cookies, local storage and imported passwords generally remain on the device. Agent tasks may still send prompts, screenshots, page context, files, tool results and conversation history to Polar’s systems and model providers. The company says its commercial provider agreements prohibit training on customer data and provide zero data retention, subject to limited exceptions.
Controls to test before wider deployment
Browser agents can encounter hostile instructions hidden in webpages, emails or documents. Researchers demonstrated the risk when BioShocking attacks tricked AI browsers into exposing sensitive data by presenting malicious prompts as game instructions.
OWASP classifies the technique as indirect prompt injection. It can divert an agent from its assigned task, expose data or trigger unauthorized actions.
Approval controls also require testing. A Claude for Chrome flaw allowed a rogue extension to trigger tasks involving Gmail, Google Docs and Google Calendar under certain conditions. The risk increased when unattended operation was enabled.
Before connecting Polar to production accounts, teams should verify:
- Identity and offboarding: Enforce multifactor authentication, least-privilege access, rapid revocation and complete removal of sessions and workflows.
- Approval gates: Define which messages, uploads, purchases, deletions or domain visits require confirmation.
- Data handling: Document what leaves the device, where it is processed and how long it is retained.
- Audit and emergency controls: Confirm that logs record actions and approvals and that administrators can stop running or scheduled tasks.
- Injection defenses: Test hostile instructions embedded in webpages, messages, documents and application records.
Organizations can begin with synthetic data, nonproduction identities and narrowly limited permissions, then expand access as testing confirms the controls and Polar provides sufficient documentation on sessions, approvals, logs, retention and administration.
Read more: 1Password’s credential-protected approach shows how temporary approval and restricted credential access can reduce the risks of allowing AI agents to operate inside authenticated accounts.