Perplexity Comet: a web page steers a browsing agent toward the user's own credentials, disclosed August 2025

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the page was a reddit post carrying the attacker's comment, on a site brave says the attacker 'doesn't control' (brave), not the attacker's page; echoleak also ran only after the user asked copilot a question (bleepingcomputer; reg-0021's mandate field).
  Show the change

  Before: The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email, the attack ran only after the user asked Comet to summarize the attacker's page. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh

  After: The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email and were picked up when the user asked Copilot an ordinary question, the attack ran only after the user asked Comet to summarize a page carrying the attacker's hidden instructions. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh
• 2026-10-20: Outcome: as of. Found in the editor's source re-check of 19-20 october 2026: the record now runs to perplexity's 22 october 2025 post describing comet's prompt-injection mitigations (pplx-mitigate); a search for later rulings, regulator action or further statements on this report found none.
  Show the change

  Before: Aug 2025

  After: Oct 2025
• 2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the interpretation now cites the patch not being shared (register) and perplexity's account (decrypt).
  Show the change

  Before: ["BRAVE"]

  After: ["BRAVE", "REGISTER", "DECRYPT"]
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: the brave post does not mention echoleak, so the comparison is the secure autonomous register's own cross-reference; it skipped a difference the record shows: the user 'asks comet to summarize' the reddit post carrying the hidden instructions, whereas echoleak (reg-0021) needed no user action on the attacker's email. the interpretation now also says what the record does not show (a brave spokesperson told the register the patch was not shared) and that brave ('still hasn't fully mitigated') and perplexity ('was patched before anyone noticed', per decrypt) disagree. the interpretation was unsigned (signed_by null); the editor signs the new wording.
  Show the change

  Before: The browsing-agent version of EchoLeak, with the user's signed-in sessions as the authority at stake. The researchers work for a competing browser maker, which readers should weigh

  After: The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email, the attack ran only after the user asked Comet to summarize the attacker's page. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh
• 2026-10-20: Fields: recovery technical: source ids. Found in the editor's source re-check of 19-20 october 2026: new sources register (patch not shared) and pplx-mitigate (vendor's described mitigations).
  Show the change

  Before: ["BRAVE"]

  After: ["BRAVE", "REGISTER", "PPLX-MITIGATE"]
• 2026-10-20: Fields: recovery technical. Found in the editor's source re-check of 19-20 october 2026: the brave post lists separating page content from instructions as a recommendation ('the browser should clearly separate the user's instructions from the website's contents'), not as a step perplexity took; the register (20 august 2025) reports that 'a brave spokesperson said perplexity did not share the patch'. perplexity's own post 'mitigating prompt injection in comet' (22 october 2025) says 'external content is demarcated as untrusted in prompts' and describes classifier checks and user confirmation for sensitive actions.
  Show the change

  Before: Patches; separation of page content from instructions

  After: Patches: an initial fix on 27 July, found incomplete on retest, and a fix that appeared to work by 13 August; a Brave spokesperson said Perplexity did not share the patch, and the sources do not say what it changed. Separating page content from the user's instructions is Brave's recommendation, alongside checking actions against the user's request, asking the user to confirm sensitive actions and isolating agentic browsing. In a later post (22 October 2025) that does not mention this report, Perplexity said Comet marks external content as untrusted in prompts, runs classifier checks on new content before acting and pauses for the user's confirmation before actions such as sending an email or making account changes
• 2026-10-20: Fields: evidence event: source ids. Found in the editor's source re-check of 19-20 october 2026: new source decrypt carries perplexity's statement.
  Show the change

  Before: ["BRAVE"]

  After: ["BRAVE", "DECRYPT"]
• 2026-10-20: Fields: evidence event. Found in the editor's source re-check of 19-20 october 2026: brave's browser is free, so 'sells' was loose; the brave post says 'we're developing the ability for our in-browser ai assistant leo to browse the web on your behalf'. 'perplexity's own statement is not in this record' was out of date: decrypt (25 august 2025) quotes a perplexity spokesperson: 'we worked directly with brave to identify and repair it'.
  Show the change

  Before: Researcher disclosure with demonstration and a dated timeline; note that the researcher sells a competing browser. Perplexity's own statement is not in this record

  After: Researcher disclosure with demonstration and a dated timeline; note that the researcher makes a competing browser and is building agentic browsing for its own assistant, Leo. Perplexity's statement is not in the Brave post; to the press, a Perplexity spokesperson said the issue was patched before anyone noticed, that no user data was compromised and that Perplexity worked directly with Brave, and Perplexity disputed the severity of the finding
• 2026-10-20: Fields: outcome: source ids. Found in the editor's source re-check of 19-20 october 2026: new source decrypt carries perplexity's account.
  Show the change

  Before: ["BRAVE"]

  After: ["BRAVE", "DECRYPT"]
• 2026-10-20: Fields: outcome: disputed. Found in the editor's source re-check of 19-20 october 2026: brave says the attack was not fully mitigated; perplexity says it was patched (brave post; decrypt, 25 august 2025).
  Show the change

  Before: false

  After: true
• 2026-10-20: Fields: outcome. Found in the editor's source re-check of 19-20 october 2026: the brave post's timeline also records 'august 11, 2025: one-week public disclosure notice sent to perplexity', and its update says 'after this blog post was released, we learned that perplexity still hasn't fully mitigated the kind of attack described here. we've re-reported this to them'; decrypt (25 august 2025) reports that 'perplexity disputed the severity of the finding' and that a spokesperson said the issue 'was patched before anyone noticed' and no user data was compromised. the two accounts disagree, so both are stated and the field is marked disputed (runbook rule 16).
  Show the change

  Before: State: averted by disclosure. Reported 25 July 2025; Perplexity's first fix came two days later and the researcher found it incomplete; the issue appeared patched by 13 August; after publication Brave said the attack still had not been fully mitigated

  After: State: averted by disclosure. Reported 25 July 2025; Perplexity's first fix came two days later and the researcher found it incomplete; Brave sent Perplexity a one-week public-disclosure notice on 11 August; the issue appeared patched by 13 August; after publishing on 20 August, Brave added that Perplexity 'still hasn't fully mitigated the kind of attack described here' and that it had re-reported the issue. Perplexity's account differs: a spokesperson told Decrypt the issue 'was patched before anyone noticed' and that no user data was compromised, and Perplexity disputed the severity of the finding
• 2026-10-16: Family. Found in an outside review of the published record on 16 october 2026: no money moved; the harm demonstrated was a leak of the user's credentials, so the case belongs with software agents.
  Show the change

  Before: transaction

  After: software
• 2026-10-16: Inference: value. Found in an outside review of the published record on 16 october 2026: the interpretation said the vendor acknowledged the mechanism, but the vendor's statement is not in this record.
  Show the change

  Before: The shopping-agent version of EchoLeak, with the user's signed-in sessions as the authority at stake. The researchers work for a competing browser maker; the vendor acknowledged the mechanism, so the Register does not lower its confidence in it

  After: The browsing-agent version of EchoLeak, with the user's signed-in sessions as the authority at stake. The researchers work for a competing browser maker, which readers should weigh
• 2026-10-13: Fields and sources. Claims aligned to what each linked record says, found on review.
  Show the change

  Before: 'later fixes followed'; 'vendor statements'

  After: timeline as the researcher records it, including its post-publication note that mitigation was incomplete; no vendor statement linked
• 2026-10-13: Context: jurisdiction. Jurisdiction text was split at a comma inside parentheses.
  Show the change

  Before: Global (vendor | competing vendor as researcher)

  After: Global (vendor, competing vendor as researcher)
• 2026-10-13: Controls: c-e1. A control has one state per case; entries in two states merged into the state the record supports.
  Show the change

  Before: failed: Session scoping; absent: Per-task isolation of logged-in sessions

  After: failed: Session scoping; Per-task isolation of logged-in sessions (absent)