TLDR: Brave Software has revealed significant security flaws in AI-powered browsers, specifically detailing how hidden instructions within images can lead to ‘indirect prompt injection attacks.’ These vulnerabilities, affecting browsers like Perplexity’s Comet and Fellou, could allow malicious actors to gain unauthorized access to sensitive user accounts, including banking and email, by tricking the AI into executing hidden commands.
Brave Software, known for its privacy-focused browser, has issued a stark warning regarding systemic security vulnerabilities discovered in several AI-powered browsers. The company’s research, published around October 21-24, 2025, highlights a critical flaw termed ‘indirect prompt injection attacks,’ which could compromise user data and accounts through seemingly innocuous image analysis features.
The core of the vulnerability lies in the AI browsers’ inability to consistently differentiate between trusted user input and potentially malicious content embedded within webpages. Brave demonstrated how hidden instructions, such as faint light blue text on a yellow background, can be concealed within images. When an AI browser, like Perplexity’s Comet, is tasked with analyzing such an image or a screenshot containing it, it inadvertently processes these hidden commands as legitimate user instructions.
According to Brave’s findings, these attacks are particularly dangerous because ‘AI assistants can act with the user’s authenticated privileges.’ This means a hijacked AI browser could gain unauthorized access to sensitive accounts, including banking sites, email providers, work systems, and cloud storage, where users might be logged in. Brave’s report explicitly warned, ‘The scariest aspect of these security flaws is that an AI assistant can act with the user’s authenticated privileges.’ They further elaborated that ‘An agentic browser hijacked by a malicious site can access a user’s banking, work email or other sensitive accounts.’ The company even illustrated a scenario where summarizing a Reddit post containing hidden malicious instructions could lead to the theft of money or private data.
Brave’s research specifically cited Perplexity’s Comet browser, demonstrating how it could be tricked into opening a user’s personal email and visiting a hacker-controlled website after analyzing a malicious image. A similar prompt injection attack was also identified in the Fellou browser, where navigating to a hacker-controlled website could lead to the AI reading the user’s email inbox and transmitting the latest email’s title to the attacker.
Also Read:
- Critical Security Flaw Discovered in OpenAI’s ChatGPT Atlas Browser: Malicious Prompts Disguised as URLs
- Sam Altman Issues Stark Warning on AI’s Potential for Societal Disruption
These revelations come at a pivotal time as the browser market sees an increasing integration of AI functionalities, with companies like OpenAI launching their own AI-powered browsers such as ChatGPT Atlas. Brave describes indirect prompt injection as a ‘systemic challenge’ facing AI browsers, rather than an isolated issue, emphasizing the need for robust safeguards. The company has reported these vulnerabilities to the affected parties and continues to advocate for clearer boundaries between trusted user input and untrusted web content in the development of AI-driven browsing experiences.
