TLDR: Brave security researchers have identified and reported a significant indirect prompt injection vulnerability in Perplexity AI’s Comet web browser. The flaw allowed malicious instructions embedded in webpages to be executed by the AI assistant, potentially leading to sensitive user data exfiltration and account takeover. Perplexity has released patches, though Brave initially noted incomplete mitigation.
Brave, the privacy-focused browser developer, has revealed a critical security vulnerability in Perplexity AI’s Comet web browser, highlighting the inherent security challenges in the emerging field of “agentic” AI browsers. The flaw, an indirect prompt injection, could have allowed attackers to manipulate Comet’s AI assistant into performing unauthorized actions, including the exfiltration of sensitive user data.
The vulnerability was discovered by Brave’s Senior Mobile Security Engineer Artem Chaikin and VP of Privacy and Security Shivan Kaul Sahib during a comparative analysis of various AI browser implementations, including Brave’s own AI assistant, Leo. Their research aimed to understand and address the security and privacy risks associated with AI agents that can browse the web and complete transactions autonomously.
At the core of the Comet vulnerability was its method of processing webpage content. When a user requested a summary of a webpage, Comet’s underlying Large Language Model (LLM) ingested parts of the page directly without distinguishing between legitimate user instructions and untrusted content from the webpage itself. This critical oversight enabled attackers to embed hidden or disguised malicious instructions within a webpage, which the AI would then execute as commands.
Brave demonstrated a proof-of-concept attack where malicious instructions, hidden behind a spoiler tag in a Reddit comment, could be processed by Comet. When the user asked Comet to summarize the Reddit thread, the AI followed the hidden commands to find and exfiltrate the user’s Perplexity login details, including their email address and a one-time password (OTP), leading to a complete Perplexity account takeover. Other potential exploits included navigating to a user’s banking site, extracting saved passwords, or sending sensitive information to an attacker-controlled server.
Brave reported the issue to Perplexity on July 25, 2025. Perplexity acknowledged the vulnerability and implemented an initial fix two days later, on July 27, followed by a more comprehensive patch on July 28. Brave conducted further testing and confirmed the vulnerability appeared to be patched by August 13, 2025, before publicly disclosing the details on August 20, 2025.
Chaikin and Sahib emphasized the broader implications of their findings, stating, “This vulnerability in Perplexity Comet highlights a fundamental challenge with agentic AI browsers: ensuring that the agent only takes actions that are aligned with what the user wants.” They stressed that “As AI assistants gain more powerful capabilities, indirect prompt injection attacks pose serious risks to Web security.”
Brave’s recommendations for enhancing agentic AI browser security include the necessity for browsers to clearly distinguish between user instructions and untrusted website content. They advocate for new security and privacy architectures, moving beyond traditional web security techniques, especially as AI agents are entrusted with sensitive data in authenticated sessions. While Perplexity implemented fixes, Brave noted in an update to their blog post that the issue was not yet fully mitigated, and Perplexity had not shared the patch details, as Comet’s code is not open source.
Also Read:
- The Imperative of Secure Browsers in the Era of AI Agents: A New Cybersecurity Frontier
- ChatGPT Agent Successfully Bypasses Cloudflare CAPTCHA, Sparking Cybersecurity Alarm
This incident serves as a stark reminder that security and privacy must be foundational, not an afterthought, in the rapid development of powerful AI tools.
