We need to make you aware of a new category of software that poses a significant security and data privacy risk to our students and our district: AI-powered web browsers.
You may see news about browsers like ChatGPT Atlas (from OpenAI) and Perplexity Comet. These are not standard browsers like Chrome. They are built with powerful AI “agents” that can take actions on a user’s behalf, such as summarizing pages, booking appointments, or even completing tasks for them.
While the features may sound helpful, they introduce severe dangers that violate our student data privacy obligations and acceptable use policies. Teachers and students should not be using these browsers for school-related business.
The Core Dangers: Why These Browsers Are Not Permitted
- Extreme Data Privacy & FERPA Risks:
- Unlike Chrome, these browsers are designed to read, understand, and “remember” the entire content of every webpage a student visits.
- OpenAI’s “Browser Memories” feature in Atlas, for example, creates a persistent profile of the user’s activity.
- Using these tools with any student information (grades, IEPs, or even just student names) could be a direct violation of FERPA, as unvetted third-party companies would be collecting and storing protected educational data.
- Critical Security Vulnerabilities (Prompt Injection):
- Security researchers have demonstrated a new attack called “indirect prompt injection.”
- This is where a malicious website hides invisible instructions (in code, comments, or even white text on a white background) on its page.
- When a student simply asks the AI to “summarize this page,” the AI can be tricked into executing those hidden, malicious commands without the student’s knowledge.
- In documented tests, attackers used this method to steal a user’s email, access their private Gmail account, and extract passwords.
- “Agent Mode” Can Be Hijacked:
- The “agent mode” in these browsers is designed to take autonomous actions for the user.
- OpenAI itself warns that these agents are “susceptible to hidden malicious instructions” and that their “safeguards will not stop every attack.”
- This could lead to an AI agent being tricked into downloading malware, making unauthorized purchases, or sending sensitive data from a student’s account to an attacker.
Our Policy: Google Chrome is Required
Our district’s acceptable use policy, which requires that all students (including BYOD) log in to and use Google Chrome, is in place specifically to prevent these kinds of risks.
- Google Chrome is Vetted: We manage the Chrome environment. We control the extensions, enforce safe browsing, and have a data privacy agreement (DPA) with Google that ensures FERPA compliance.
- AI Browsers Are Unvetted: We have no DPA with these new companies. They are not enterprise-ready for schools and, as one security firm noted, can be up to 85% more vulnerable to phishing attacks than Chrome.
What to Do:
- Do Not Install: Please ensure these browsers (ChatGPT Atlas, Perplexity Comet, etc.) are not installed on any school device. If you as a teacher bring your own device to work, do not use these browsers for school-related business.
- Talk to Your Students: Remind students that using unapproved software on their BYOD devices while connected to the school network is a policy violation. Explain that while the new features seem “smart,” they can easily be tricked into stealing their personal information.
- Reinforce Chrome Use: Please ensure students on BYOD devices are logged into their school-provided Google Chrome profile. This is our first and best line of defense.
If you have any questions, please submit a tech ticket.
Thank you for your help in keeping our students and their data safe.
