Prompt Injection Hijacks Perplexity's Comet AI Browser
On this page
The agentic-browser era's first big lesson: an AI that browses for you will also obey the pages it reads.
| When | August 2025 |
|---|---|
| Target | Perplexity Comet (agentic AI browser) |
| Vendor | Perplexity |
| Researchers | Brave security team (Chaikin, Sahib) |
| Technique | Indirect injection via hidden web-page text |
| Disclosed | Reported Jul 25; public Aug 20, 2025 (initial fix incomplete) |
- 1User asks Comet to “summarise this web page”
- 2Comet feeds the page to its LLM without separating your request from the page's text
- 3Hidden page instructions run with your logged-in privileges — reaching accounts and leaking an OTP
What happened
In August 2025, Brave's security team showed that Perplexity's Comet — an “agentic” browser that can act on your behalf — could be hijacked by the very pages it reads. Asked to summarise a page, Comet fed the page's content to its model without separating the user's request from untrusted text. Hidden commands (white text, HTML comments, even inside a social-media comment) were executed as if the user had typed them. Because the agent acts with the user's logged-in privileges, a proof of concept reached the user's accounts, read email, obtained a one-time passcode, and exfiltrated it.
How the attack worked
There was no boundary between “what the user asked” and “what the page said” — both reached the model as one prompt. So an instruction on the page could redirect the agent, and an agent that can read, click, and navigate while you are signed in turns that into real account access.
A systemic problemBrave framed this as a class issue for agentic browsers, not a one-off Comet bug: any agent that reads untrusted web content and can act on your behalf inherits it.
Root cause
Trusted user intent and untrusted page content share one context, and the agent holds the user's ambient authority across every logged-in site.
What a test would have caught
Feeding an agentic browser a page with hidden instructions and checking whether it acts on them — navigates, reads private data, or makes a request — is the core agentic-injection test.
How to prevent it
- Separate user instructions from page content — page text is data, never commands.
- Require explicit confirmation for anything sensitive the agent does.
- Constrain authority: a “summarise” task should not be able to touch authenticated accounts.
Feel it yourselfThe replay lab lets you plant instructions in content an assistant reads and watch it obey them.
FAQ
Isn't the browser just doing what I asked?
No — you asked only to summarise a page. The page contained hidden instructions the agent executed as if they were yours, with your logged-in access. The agent couldn't tell your request from the page's content.
What could the hijacked agent actually do?
In Brave's proof of concept it reached the user's authenticated accounts, read sensitive data such as email, obtained a one-time passcode, and exfiltrated it — because an agentic browser acts with your privileges everywhere you're signed in.
Is this specific to Comet?
No. Brave framed it as a systemic problem for agentic browsers: any agent that reads untrusted web content and can act on your behalf inherits it unless user instructions and page content are strictly separated.