Browser, IDE, and OS: The Three Battlegrounds for AI Interfaces

Every computing era has been decided less by who had the best technology than by who controlled distribution. The PC era belonged to whoever owned the operating system. The web era belonged to whoever owned the browser and the search box. The mobile era belonged to whoever owned the app store. Artificial intelligence is following the same pattern. Frontier models are becoming more capable, more numerous, and in many tasks more interchangeable. What is not interchangeable is the surface through which people actually meet them.

In 2025 and 2026 that contest crystallised around three surfaces. The first is the AI browser, where assistants read pages, fill forms and complete tasks across the open web. The second is the developer environment, where AI coding agents have moved from autocomplete to autonomous pull requests. The third is the AI operating system layer, where Apple, Google and Microsoft are wiring models and agent protocols directly into the platforms billions of devices already run.

This article is an evergreen map of those three battlegrounds: what each one controls, who is fighting over it, and the question that cuts across all three, which is whether the winning interfaces will be open or closed.

Why the interface matters more than the model

A model on its own is a capability. An interface is a habit. When a user opens the same window dozens of times a day, the company that owns that window decides which model answers, which data it may see, which actions it may take, and who earns money when it takes them.

Three properties make an interface valuable for AI in particular:

• Context. The assistant that sees what you are already doing (the page you are reading, the file you are editing, the notification you just received) needs far less prompting and gives far better answers.
• Permission to act. Answering is cheap; acting is valuable. The surface that holds your logins, your repositories or your files is the one that can safely be given authority to do things.
• Default status. Defaults are sticky. Most users never change the search engine their browser ships with, and there is no reason to assume they will behave differently with assistants.

Each of the three battlegrounds offers these properties in different proportions. The browser offers the broadest context across the web. The IDE offers the deepest permission to act, because code is a domain where actions can be reviewed, tested and rolled back. The operating system offers the strongest default status, because it sits beneath everything else.

Battleground one: the AI browser

From sidebar to agent

The browser was the first surface to be attacked head-on. Perplexity launched its Comet browser in July 2025 for top-tier subscribers, then on October 2, 2025 made it free to download for everyone, adding “background assistants” that let paying users run several agentic tasks in parallel. Comet’s pitch, as The Verge summarised it, is an assistant that travels the web with you rather than being “tacked onto a traditional browser.”

On October 21, 2025, OpenAI followed with ChatGPT Atlas, a browser “built with ChatGPT at its core,” initially for macOS. Its three headline features were a chat sidebar available on any page, browser memory, and an agent mode that could click through sites to research, book or edit on the user’s behalf. Reuters framed the launch as a direct challenge to Chrome and noted that it let OpenAI capitalise on roughly 800 million weekly ChatGPT users. Notably, OpenAI’s own announcement page now states that Atlas “has since been deprecated” and points readers to a newer work-oriented product.

Incumbents did not stand still. Google brought Gemini into Chrome and, on January 28, 2026, announced “auto browse,” an agentic feature for multi-step tasks such as researching trips, filling in forms and shopping, initially in preview for paying US subscribers and with confirmation required for sensitive actions. Opera launched Neon, and The Browser Company pivoted from Arc to its AI-first Dia.

What is really at stake

Underneath the feature race is a fight over the economics of the web. Search advertising depends on people clicking links. An agent that reads ten pages and returns one answer, or simply completes the purchase, removes the click that pays for much of the open web. Whoever owns the agentic browser is therefore positioned to own the next version of the search and commerce funnel. Perplexity’s experiment with Comet Plus, a $5-per-month tier intended to share revenue with publishers, is one early attempt to rebuild that bargain.

There is also a structural irony. As Vox observed, almost all of these “new” browsers are built on Chromium, the open-source project Google founded. The rendering engine is open and shared; the differentiation lies entirely in the AI layer and the account behind it.

The security problem

The browser is also the most hostile environment an agent can work in. Every page it reads is untrusted input. In August 2025, Brave’s security team published research showing indirect prompt injection in Comet: instructions hidden in a web page could be treated as commands when the assistant summarised the page, potentially letting an attacker steer actions across sites the user was logged into. Follow-up research described injections hidden in screenshots and affecting other AI browsers. Brave’s recommendations — strictly separating the user’s instructions from page content, demanding confirmation for sensitive actions, and isolating agentic browsing from ordinary browsing — are fast becoming the baseline design pattern. Until that problem is convincingly solved, the AI browser will remain powerful but supervised.

Battleground two: the IDE and AI coding agents

The fastest-moving surface

If the browser is the broadest battleground, the developer environment is the most mature. Software is the domain where AI agents found product-market fit first, because their output can be compiled, tested, diffed and reviewed before it touches anything important.

The scale of adoption is visible in Stack Overflow’s 2025 Developer Survey, which collected more than 49,000 responses from 177 countries. It found that 84% of respondents were using or planning to use AI tools in their development process, up from 76% the year before, and that 51% of professional developers used them daily. The same survey also exposed a trust gap: positive sentiment fell to 60% from more than 70% in previous years, and the top frustration was AI output that is “almost right, but not quite.” Agents had not yet conquered everyone: 52% of developers said they either did not use agents or stuck to simpler AI tools.

From autocomplete to agent fleets

The interface itself has changed shape three times in quick succession. First came inline completion inside the editor. Then came chat panels and AI-native editors that could edit many files at once. Then came terminal and cloud agents that take a task, work in their own environment, and return a pull request for human review.

The most telling development is GitHub’s response. At its Universe conference in October 2025, GitHub announced Agent HQ, which lets paid Copilot subscribers assign, monitor and govern not only GitHub’s own coding agent but third-party agents from Anthropic, OpenAI, Google, Cognition and xAI, across GitHub, VS Code, mobile and the command line. In other words, the company that owns the repository decided that its moat was not any single agent but the place where all agents report their work.

Where control really lives

That move reveals the shape of the IDE battleground. There are three layers, and each has a different owner:

1. The model, increasingly a commodity the developer can switch with a dropdown.
2. The editor or agent harness, fiercely contested between AI-native editors, terminal agents from model labs, and extensions inside established editors.
3. The system of record — the repository, the CI pipeline, the code review queue — where agent output must ultimately land and be approved.

Open protocols are lowering the walls between these layers. The Model Context Protocol (MCP), introduced by Anthropic in late 2024, gives agents a standard way to plug into tools, documentation and internal services, which means a developer’s integrations are no longer locked to one assistant. The likely end state is a world in which developers mix and match agents freely, and value accrues to whoever owns review, governance and billing.

Battleground three: the AI operating system

The quiet giant

The operating system is the least flashy battleground and possibly the most decisive, because it is where the other two run. Whoever owns the OS can decide which assistant answers the system-wide shortcut, which agents may see the file system, and which models run locally for free.

Apple: on-device by default

At WWDC 2025, Apple introduced the Foundation Models framework, giving app developers direct access to the roughly 3-billion-parameter on-device model behind Apple Intelligence. Apple’s own materials stress that it runs on-device, works offline, does not increase app size and costs developers nothing per request. Features such as guided generation, which maps model output straight into Swift data types, and tool calling make it practical to build structured AI features without a server. Apple is candid that the model “is not designed to be a chatbot for general world knowledge”; it is designed to be an always-available utility inside every app. That is the essence of an AI operating system: intelligence as a system service rather than a destination.

Google: Gemini Nano through Android

Google is pursuing a similar strategy on Android. Its ML Kit GenAI APIs, announced in May 2025, let apps call Gemini Nano on-device through the system’s AICore service for tasks like summarisation, proofreading, rewriting and image description, with no network dependency or per-call server cost. Combined with Gemini as the system assistant, Google controls both the on-device and cloud ends of the experience on the world’s most widely used mobile OS.

Microsoft: Windows as an agent host

Microsoft has taken the most explicitly agentic approach. At Build 2025 it announced plans for native MCP support in Windows 11, and at Ignite in November 2025 it moved that support to public preview. Windows now offers an on-device registry where apps can expose “agent connectors,” which are MCP servers, with built-in connectors for File Explorer and Settings. All traffic flows through an MCP proxy that handles authentication, authorisation and auditing. Microsoft’s argument is straightforward: secure agent infrastructure “can’t be delivered through middleware or applications alone — it demands OS-level integration.”

Edge and cloud, not edge versus cloud

The pattern across all three platform owners is hybrid. Small on-device models handle private, latency-sensitive, everyday tasks for free. Larger cloud models handle complex reasoning, usually under the platform owner’s own brand or through a negotiated partnership. For users this means better privacy and responsiveness. For the platform owners it means a new form of lock-in: the cheapest, fastest and most private AI on any device will be the one the OS vendor ships.

Open vs closed: the question that cuts across all three

Each battleground has its own mix of openness and control, and the balance is not settled.

The case for open

The strongest force pushing towards openness is interoperability. MCP has, in a short time, become a common language adopted by model labs, IDE vendors and even Microsoft at the OS level. Chromium means every AI browser shares an open foundation. GitHub’s Agent HQ deliberately hosts its competitors. Open-weight models make it possible to run capable assistants locally without any platform owner’s permission. When integrations are portable, users can switch assistants without losing their tools, and competition shifts to quality.

The case for closed

The forces pushing towards closure are just as real. On-device models are tied to specific hardware and operating systems. Browser memory and agent histories are stored in proprietary accounts. System-level assistant shortcuts are defaults that only the OS vendor can assign. Security gives platform owners a legitimate reason to restrict access: an OS that lets any agent read any file would be reckless, and the vendor that writes the permission rules also gets to decide who passes them.

A likely equilibrium

The most plausible outcome is “open protocols, closed defaults.” The pipes — MCP connectors, Chromium engines, Git repositories — will be shared. The surfaces people touch first, and the defaults inside them, will remain owned. That is not so different from the web itself: open standards underneath, a handful of dominant gateways on top.

What this means for builders and buyers

For product teams, the lesson is to build for the protocol rather than the platform. Exposing a product’s capabilities as an MCP server, or as structured tools that an on-device model can call, makes it reachable from browsers, IDEs and operating systems alike.

For developers, it means treating coding agents as interchangeable workers and investing instead in the things that make any agent productive: good tests, clear repository conventions, and a disciplined review process. The survey data on trust suggests review is where the human remains indispensable.

For IT and security leaders, it means the three battlegrounds are also three attack surfaces. Agentic browsers need isolation and confirmation policies; coding agents need scoped credentials and audit trails; OS-level agents need clear consent and logging. The vendors that make governance easy will win enterprise deployments even if their models are not the very best.

For everyone, it is worth remembering that specific products are volatile. Browsers launch and are deprecated within a year; editors rise and fall within months. The battlegrounds themselves, however, are durable. Wherever attention, permission and defaults meet, AI distribution will be decided.

Related reading

• From Chatbots to Work OS: How AI Assistants Are Swallowing Enterprise SaaS
• Computer-Use Agents Enter Production: What Actually Works in the Enterprise
• Open-Weight Frontier Models vs Closed APIs: The Sovereignty Trade-Off

Images: original illustrations generated for AndBeyond.Tech; no logos or real people depicted.