Summary
In August 2025, Brave's security and privacy researchers published an analysis of Comet, Perplexity's browser with a built-in AI agent. They reported an indirect prompt injection weakness in how Comet processed webpage content for the agent: when a user asked the agent to work with a page, content on that page could steer the agent's behavior while it operated inside the user's logged-in browser.
This record is a red-team finding. It documents a controlled demonstration by researchers, not observed attacks on Comet users.
Classification and evidence status
| Field | Value |
|---|---|
| Record type | Red-team finding |
| Public disclosure | 2025-08-20 |
| Vendor / product | Perplexity / Comet |
| Attack class | Indirect prompt injection |
| Delivery vector | Web content - attacker-controlled content on a webpage that the user asks the browser agent to process |
| Affected data / capabilities | Authenticated browser sessions and actions the Comet agent could take on the user's behalf |
| Demonstrated impact | In the researchers' demonstration, the agent was steered to access sensitive information and act outside the summarized page |
| In-the-wild status | No in-the-wild exploitation reported in cited sources. The disclosure describes a controlled research demonstration only. |
| Remediation status | Unknown. Brave's timeline reports an initial Perplexity fix, retesting that found it incomplete, and a later note that the attack class was still not fully mitigated after publication and was re-reported. Current status of the product: unknown. |
| Identifiers | No identifier listed |
| External score | No external score shown |
Affected system and trust path
An agentic browser combines two very different things in one context: the page a user asks about, which is variable content from any website, and the user's own authority, including active sessions on other sites. If page content can shape which actions the agent takes, third-party text effectively borrows the user's authenticated capabilities. Familiar web isolation assumptions, where one site cannot act on another, do not automatically hold for an agent that acts across sites.
High-level attack chain
At a high level: attacker-controlled content is placed on a webpage; the user asks the browser agent to work with that page; the content enters the agent's context alongside the user's request; the agent is influenced to use authenticated browser capabilities beyond the task; this can lead to access to or disclosure of sensitive information.
This record does not reproduce how content was hidden on the page, any instruction wording or the specific sequence of browser actions.
Demonstrated impact vs observed exploitation
Demonstrated: in the researchers' controlled test, page content steered the agent to access sensitive information and take actions outside the page being summarized.
Observed against real users: none reported in the cited source. Steering the agent is model influence; the security impact came from the agent holding the user's authenticated browser capabilities without a boundary tied to the user's actual request.
Enabling control gaps
- Webpage content and the user's request shared one context without a distinction that limited the page's influence on actions.
- The agent could use authenticated sessions on other sites without authorization bound to the scope of the user's task.
- Sensitive actions and data flows were not gated by an explicit, action-specific confirmation.
Vendor and researcher response
Brave's disclosure timeline states that the issue was reported to Perplexity on 2025-07-25, that Perplexity acknowledged it and implemented an initial fix on 2025-07-27, that retesting found that fix incomplete, and that final testing on 2025-08-13 initially appeared to show it patched. Brave later added to the article that further testing after publication showed the attack class was not fully mitigated and that it had been re-reported. This record therefore uses the status "unknown": the source documents an incomplete or uncertain state at publication and does not establish the current state of the product.
Evidence defenders should retain
- Where available, the browser agent's navigation and action history, linked to the user request that started each task.
- Lineage of page content that entered the agent's context for each task.
- Records of agent actions on sites other than the one the user asked about, including account and settings changes.
- Outbound requests and form submissions made by the agent to destinations not involved in the original task.
Defensive lessons
- Agent Authorization: bind the agent's permissions to the user's stated task instead of the full authority of the browser session.
- Least Privilege: separate agent browsing from sessions on sensitive sites where possible.
- Information Flow Control: prevent data read from one origin or account from flowing to destinations the task does not require.
- Data Provenance: keep page content labeled as third-party data so it cannot count as a user instruction.
- Human-in-the-Loop: require confirmation for sensitive actions, with the concrete action shown, while remembering that approval is not authorization.
Related Learn topics
- AI Agents and Tool Calling - How model proposals become actions: the tool-calling loop, availability vs permission, runtime authorization, approval, tool results as variable data and audit.
- Trust Boundaries and Model Context - What model-visible context is, why position does not create trust, and why controls sit outside the model.