Comet: an AI browser that read your email when you asked it to summarize a page

What happened

Comet is Perplexity's AI-powered browser, which can read the current page and act on the user's behalf. Brave's security team disclosed a vulnerability in which Comet failed to distinguish the user's instructions from untrusted content on the page it was summarizing.

An attacker embedded malicious commands in hidden webpage elements — white text on a white background, HTML comments, or spoiler tags. When the user asked Comet to "Summarize this page," the assistant processed those concealed instructions as if they were legitimate requests. In Brave's proof of concept, the injected commands drove Comet to navigate to the user's authenticated services, read the user's email address and a one-time password, and exfiltrate them to the attacker — enough for a complete account takeover of Perplexity services. Because Comet acted with the user's logged-in sessions, the same class of attack could reach banking sites, private email, and other authenticated accounts. Brave reported the issue was discovered on July 25, 2025 and disclosed on August 20, 2025; Perplexity shipped an initial patch, though Brave found the fix incomplete in follow-up testing.

Root cause

• LLM01 Prompt Injection (indirect). Comet merged untrusted page content with the user's request and executed hidden instructions — the trust-boundary failure at the heart of every indirect-injection breach.
• LLM06 Excessive Agency. The browser could autonomously navigate to authenticated services and read sensitive data (email, OTP) using the user's own sessions, with no confirmation gate before acting.

How it would have been caught

An injection probe that seeds a benign-looking page with hidden instructions and then invokes the summarize action — while monitoring whether the agent navigates to authenticated endpoints or issues outbound requests carrying user data — would have surfaced the takeover. Promptfoo, Garak, and PyRIT cover the injection generation; the decisive check is confirming the agent never reaches credentials or an OTP from page-supplied text.

How to prevent it

• Treat page content as untrusted data in labelled blocks, strictly separated from the user's instruction to the assistant.
• Gate any cross-origin navigation to authenticated services and any data egress behind explicit user confirmation.
• Deny the agent the ability to read and forward credentials or one-time passwords as a result of page-derived instructions.

The Breachwire test (red → green)

Load a page carrying hidden instructions, trigger "summarize," and confirm the agent reads and exfiltrates an email address and OTP (the RED control proving takeover is reachable). Apply untrusted-content separation and navigation gating, then confirm the same page no longer reaches credentials, while a benign summarize on a normal page still produces a correct summary (the positive control).