Applets are Java programs that live in a web page and are therefore "runnable" in a browser (IE, Opera etc) when you navigate to the page.
As far as security is concerned applets can run in two ways. Firstly they can operate in what is known as a "sandboxed" environment where they have no access to any of the resources on your machine. This means they can't do things like read to and from your local directory structure. The second way they run is where they have access to your machine and it's resources. Effectively the second way means that the applet will have the same security priveledges as any Java application running locally on your machine.
The second way can be achieved by running an applet that has been published by a source that you trust. This trust is achieved by a process called "signing" where a cryptographic assurance is provided to the client by the provider to guarantee that the applet comes from a trusted party. The only places in which I have seen signed applets in action is in an intra/extranet environment.
Most of the applets you see on public sites are of type one and they can't tamper with your system. When you close your browser or navigate off the page the applet will cease to run.
Hope this helps.