Researchers detail systemic vulnerabilities in AI agentic browsers, including Perplexity's Comet and Fellou, related to indirect prompt injection attacks
Building on our previous disclosure of the Perplexity Comet vulnerability, we've continued our security research across the agentic browser landscape.
Brave
Context & Ripple Effects
This extends Brave’s earlier report of a now-fixed Comet prompt-injection flaw from a single product issue to a broader agentic-browser security question. That matters as Comet, Fellou and other AI-first browsers compete for users alongside established browser platforms.
The findings arrive during an intensifying contest among AI-enhanced browsers, where product differentiation increasingly depends on agents acting for users rather than merely summarizing pages.
First-order effects
Comet, Fellou and other affected agentic-browser developers face immediate pressure to investigate indirect prompt-injection paths and tighten the controls governing browser actions.
Users and organizations evaluating these browsers must treat content encountered on the web as potentially untrusted input when an agent can act on their behalf.
Second-order effects
Browser rivals marketing autonomous assistance will need to show that their permissions, confirmation flows and isolation measures limit what malicious page content can induce an agent to do.
Security testing shifts from model-output quality toward end-to-end agent behavior: the relevant risk is the combination of web content, agent instructions and privileged browser actions.
Third-order effects
If similar findings persist across products, agentic browsers may be judged less by their ability to complete tasks than by whether they enforce a durable authorization boundary between untrusted content and user-authorized actions.
The pattern could push the category toward more constrained agent permissions and clearer user approval gates, though the supplied coverage does not establish which technical design will prevail.
The trend: As browsers become delegated-action interfaces, indirect prompt injection is becoming a core product-security and trust challenge rather than an isolated model-safety defect.
This is really beautiful. Because an LLM can't distinguish between content and code, you can instantly kill an AI Browser by hiding a few lines of mischievous instruction on your web page. All that money invested in such a dumb technology.
Be *very* careful with Agentic browsers. I'm definitely not a fan of connecting my passwords or password manager to an AI that can get fooled by a website.
Agentic browsers are a big attack vector, the surface area exposure being huge and security for them is still at a nascent stage and evolving. Don't use them at least as your primary browser. Or for anything that you have log in to or need to share sensitive data for.
With JS, I had to invent the Same Origin Policy in a hurry. OCap design ideas in “JS, the Good Parts” saved much of the day. My OWASP USA 2012 talk: https://www.slideshare.net/... AI browsers now let web content violate security policies. @Brave is on the case. https://brave.com/…
Seems important evidence of poor design. 🤔 “Indirect prompt injection attacks occur when malicious instructions are hidden in web content like webpages. When an LLM analyzes the content, it obeys the hidden instructions because it believes they're real commands from the user.”
We've moved from prompt engineering to context engineering, and now we need the security layer. Context injection attacks demand the same defensive rigor as SQL injection once did.
Browser: You control (to a large extent) AI Browser: AI controls - what if they go out of control? Not just Comet, but also Atlas or any other... It's very early days to give access to your Prime accounts.
Not sure how we're gonna solve this just yet but agentic browsers are wildly vulnerable to prompt injection. A site can literally embed hidden instructions anywhere in the page and hijack the agent's flow. Feels like an agent needs guardrails that look something like:
This is Fine in the long run. Browsers for clankers are not browsers for citizens and their credentials. Ideally, they will be hardlocked into a separate system of APIs and a wholly segregated Clankernet. The back section of the World-Wide Bus. [image]
prompt injection at the browser level! new attack vector. basically both comet from Perplexity and Atlas from OpenAI can be used to prompt inject by hidden content in the web pages
Indirect prompt injection attacks occur when malicious instructions are hidden in web content like webpages. When an LLM analyzes the content, it obeys the hidden instructions because it believes they're real commands from the user.