Researchers detail a now-fixed flaw in Perplexity's Comet AI browser that let an attacker use an indirect prompt injection to manipulate it into taking actions
Brave and Guardio's security audits call out paid AI browser Victor Tangermann / Futurism : Using an AI Browser Lets Hackers Drain Your Bank Account Just by Showing You a Public Reddit Post Marcus Schuler / Implicator.ai : Perplexity's Comet obeyed hidden prompts, exposing logged-in accounts Larry Dignan / Constellation Research : Secure browsers will matter more with AI agents Bill Toulas / BleepingComputer : Perplexity's Comet AI browser tricked into buying fake items online Sam Chapman / Engadget : AI browsers may be the best thing that ever happened to scammers Lance Whitney / ZDNET : Perplexity's Comet AI browser could expose your data to attackers - here's how Thomas Claburn / The Register : Perplexity's Comet browser naively processed pages with evil instructions The Hacker News : Experts Find AI Browsers Can Be Tricked by PromptFix Exploit to Run Malicious Hidden Prompts X: Zack / @zack_overflow : Why is no one talking about this? This is why I don't use an AI browser You can literally get prompt injected and your bank account drained by doomscrolling on reddit: [image] Ezra ‘God’ Olubi / @0x : fascinating when you think of the fact that ai-native browsers and stuff like dia's “mention any tab in your chats” make a mockery of all the security mechanisms like tab isolation, etc built into browsers over the past several years. Shivan Kaul Sahib / @shivan_kaul : Hard to overstate how scary this attack is. It takes one click for a user on a random Reddit post => complete Perplexity account takeover. Agentic browsing is rife with security and privacy pitfalls and needs very careful design. @lukemulks : Never been a more important time to apply user-first principles to user agents than now. Chat form factor has natural feel that can be disarming, and many of these new offerings have unprecedented access to everything you do (in some cases, with permission to share that info @brave : One example attack: 1. A Comet user sees a Reddit thread where one comment has hidden instructions. 2. The user asks Comet to summarize the thread. 3. Comet follows the malicious instructions to find the user's Perplexity login details and send them to the attacker. [video] Zack / @zack_overflow : No one seems to be concerned about this, it seems to me like the #1 problem with any agentic AI stuff You can get pwned so easily, all an attacker has to do is literally write words down somewhere??? @brave : These malicious instructions could be white text on a white background or HTML comments. Or they could be a social media post. If Comet sees the commands while summarizing, it will follow them even if they could hurt the user. This is an example of an indirect prompt injection. @brave : In today's blog post, we share more details on this vulnerability and discuss potential protections against other attacks of this nature. Perplexity has patched this error since we reported it to them. https://brave.com/... Zack / @zack_overflow : Usually when you read a security vulnerability report it's usually a combination of some low-level shit like: “exploit a bug in the Linux kernel to get a use-after-free via a refcounting bug to overwrite a vtable pointer to-” Here it's literally “we wrote reddit comment then it [image] @brave : This security flaw stems from how Comet summarizes websites for users. When processing a site's content, Comet can't tell content on the website apart from legitimate instructions by the user. This means that the browser will follow commands hidden on the site by an attacker. @brave : This attack demonstrates the risks presented by AI agents operating with full user authentication across multiple sites. New security measures are needed to make agentic browsing safe. Zack / @zack_overflow : Furthermore, it seems like very high profile and rich people and investors are trying out these AI browsers, seems like a really easy way to pwn someone with a lot of money: https://x.com/... @brave : AI agents that can browse the Web and perform tasks on your behalf have incredible potential but also introduce new security risks. We recently found, and disclosed, a concerning flaw in Perplexity's Comet browser that put users' accounts and other sensitive info in danger. [image] Bluesky: Sung Kim / @sungkim : I am guessing Brave really does not want to be bought by Perplexity, or do they? — Brave finds that there is a concerning flaw in Perplexity's Comet browser that put users' accounts and other sensitive info in danger. — brave.com/blog/comet-p... Mastodon: Simon Willison / @simon@fedi.simonwillison.net : There is some good news here: the Hacker News thread about this topic is refreshingly packed with people who clearly understand the nature and severity of the problem and get why none of the proposed mitigations are likely to work out https://news.ycombinator.com/ ... Forums: Hacker News : Comet AI browser can get prompt injected from any site, drain your bank account Hacker News : Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet Beehaw : Comet AI browser can get prompt injected from any site, drain your bank account
Context & Ripple Effects
This disclosure supplied a concrete example of the agentic-browser security problem: an assistant operating in an authenticated browser session could treat untrusted page material as instructions. Perplexity says the reported flaw was patched after notification.
The issue sits in a widening product shift toward browser-embedded agents, including Chrome's planned agentic features. Subsequent research reporting described systemic vulnerabilities across agentic browsers, suggesting the concern extends beyond one implementation.
First-order effects
- Comet users are protected from this reported injection path after Perplexity's patch, while Perplexity must treat page summarization as a security boundary rather than a purely retrieval task.
- The finding makes clear that logged-in browser sessions and delegated actions—such as purchases—can be exposed when hidden page content is interpreted as agent commands.
Second-order effects
- AI-browser makers face pressure to add stronger separation between user intent, web content, and action execution; otherwise, each new autonomous capability expands the practical impact of prompt injection.
- Merchants and services that let browser agents transact may need more explicit confirmation and permission controls, particularly for actions initiated from untrusted pages.
Third-order effects
- If agentic browsing becomes mainstream, browser security is likely to shift from protecting page rendering to governing an agent's authority over accounts, data, and transactions—the broader agentic-browser vulnerability pattern points in that direction.
- The durable differentiator may become how narrowly agents can be authorized and audited, rather than how many web tasks they can complete autonomously.
The trend: AI browsers are turning prompt injection from a model-behavior problem into an execution-and-permissions problem for authenticated web agents.