Perplexity Comet AI browser vulnerable to indirect prompt injection attacks
Researchers from Brave and LayerX discovered an indirect prompt injection vulnerability in Perplexity's Comet AI browser. The flaw allowed attackers to use malicious URLs or webpage content to hijack the AI agent and exfiltrate sensitive user data from connected services like Gmail and Google Calendar.
CommetJacking shows how a single, weaponized URL can quietly flip an AI browser from a trusted co-pilot to an insider threat.
Key facts
- What
- Researchers from Brave and LayerX discovered an indirect prompt injection vulnerability in Perplexity's Comet AI browser.
- Incident date
- Aug 20, 2025
- Who
- Perplexity AI
- Failure mode
- Prompt Injection
- AI surface
- Agentic Workflow
- Severity
- High
What happened
Attackers utilized malicious URLs and webpage content to trigger indirect prompt injections in the Comet AI browser. This allowed them to hijack the agent and exfiltrate sensitive data from connected services, such as Gmail and Google Calendar, by encoding the information in base64.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
Comet processed webpage content directly in its LLM prompt without distinguishing between user instructions and untrusted content. This allowed the AI to execute embedded instructions as high-privileged agent commands.
What it cost
Sources
- PrimaryAgentic Browser Security: Indirect Prompt Injection in Perplexity Cometbrave.com
- PressCommetJacking attack tricks Comet browser into stealing emailsbleepingcomputer.com
- PressCommetJacking: One Click Can Turn Perplexity’s Comet AI Browser Into a Data Thiefthehackernews.com
- PrimaryMitigating Prompt Injection in Cometperplexity.ai
Cite this entry
https://failureindex.ai/failures/perplexity-comet-browser-vulnerable-indirect-promptAI Failure Index. "Perplexity Comet AI browser vulnerable to indirect prompt injection attacks" (FI-0513). Realm Labs. https://failureindex.ai/failures/perplexity-comet-browser-vulnerable-indirect-prompt (indexed Jun 16, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0513. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.