Perplexity’s Comet AI browser exposed users to serious security risks before fix

Perplexity AI

Perplexity’s AI-powered web browser Comet was found to have a major security vulnerability that could have allowed attackers to access sensitive user information, including emails, banking details, and saved passwords. The flaw was linked to a technique known as indirect prompt injection.

Comet is one of several AI-first browsers that use large language models to complete tasks autonomously, such as summarising web pages, emails, and calendar events, managing tabs, or answering questions about on-screen content. However, researchers at rival browser company Brave discovered that Comet’s webpage-summarisation function was highly vulnerable.

According to Brave, when a user requested a summary of a webpage, Comet passed parts of the page directly into its language model without separating user instructions from untrusted content. This meant malicious actors could embed hidden instructions within websites, even on platforms such as Facebook or Reddit, and trick the browser into executing unintended actions.

The researchers explained that traditional web security safeguards such as same-origin policy and cross-origin resource sharing were ineffective in this scenario. Unlike conventional vulnerabilities that typically target individual sites, this flaw allowed cross-domain access through natural language instructions embedded in webpages.

In a demonstration, Brave showed how attackers could use Comet to take over a user’s Perplexity account by extracting personal emails, requesting OTPs, and logging into Gmail. They warned that the flaw could have been exploited to access banking data, recover saved passwords, or send private information directly to attacker-controlled servers.

Brave reported the issue to Perplexity on 11 August, but noted that the flaw was still unresolved as of 20 August. The AI startup later confirmed to CNET that the problem had been fixed. “This vulnerability is fixed… We have a pretty robust bounty program, and we worked directly with Brave to identify and repair it,” said Jesse Dwyer, Perplexity’s head of communications.