Perplexity Comet AI browser indirect prompt injection

What happened

Brave's security team showed that Comet's agentic browsing could be hijacked by instructions hidden in webpage content, including a malicious Reddit post and invisible text, letting attackers reach the user's logged-in accounts and one-time passwords. Guardio separately showed it would complete phishing flows and hand over banking details without warning.

Root cause

The agent processed page content as trusted instructions while acting with the user's authenticated browser session, so any visited page became an injection surface with real account access.

Fix / outcome

Perplexity shipped mitigations after disclosure, but researchers demonstrated follow-on bypasses. Agentic browsing remains an open problem.

Sources