{
 "schema_version": "0.4",
 "id": "REG-0025",
 "title": "Perplexity Comet: a web page steers a browsing agent toward the user's own credentials, disclosed August 2025",
 "batch": "B2",
 "family": "software",
 "context": {
  "domain": "Browsing and shopping agent acting with the user's sessions",
  "autonomy_level": "supervised",
  "actor_type": "Software: Comet browser agent",
  "actors": {
   "count": 1,
   "text": "1",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "jurisdiction": [
   "Global (vendor, competing vendor as researcher)"
  ],
  "autonomy_level_text": "Machine acts within a user request, with the user's logins",
  "mandate_context_text": "Demonstration"
 },
 "provenance_tier": "disclosure_corroborated",
 "status": "confirmed",
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "A user asking the agent to summarize a page",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "The Comet browsing agent, holding the user's logged-in sessions",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "Hidden instructions in page content, including a comment on a public forum",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "The agent treated page text as instructions, navigated to the user's account and email, and read a one-time code",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "authority",
   "value": "The agent carried every session the user had; nothing scoped it to the page being summarized",
   "assertion_type": "interpretation",
   "source_ids": [
    "BRAVE"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "Exfiltration of the user's email address and a one-time code via a post the attacker could read",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: averted by disclosure. Reported 25 July 2025; Perplexity's first fix came two days later and the researcher found it incomplete; Brave sent Perplexity a one-week public-disclosure notice on 11 August; the issue appeared patched by 13 August; after publishing on 20 August, Brave added that Perplexity 'still hasn't fully mitigated the kind of attack described here' and that it had re-reported the issue. Perplexity's account differs: a spokesperson told Decrypt the issue 'was patched before anyone noticed' and that no user data was compromised, and Perplexity disputed the severity of the finding.",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE",
    "DECRYPT"
   ],
   "confidence": "medium",
   "disputed": true
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "Researcher disclosure with demonstration and a dated timeline; note that the researcher makes a competing browser and is building agentic browsing for its own assistant, Leo. Perplexity's statement is not in the Brave post; to the press, a Perplexity spokesperson said the issue was patched before anyone noticed, that no user data was compromised and that Perplexity worked directly with Brave, and Perplexity disputed the severity of the finding",
   "assertion_type": "interpretation",
   "source_ids": [
    "BRAVE",
    "DECRYPT"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "Patches: an initial fix on 27 July, found incomplete on retest, and a fix that appeared to work by 13 August; a Brave spokesperson said Perplexity did not share the patch, and the sources do not say what it changed. Separating page content from the user's instructions is Brave's recommendation, alongside checking actions against the user's request, asking the user to confirm sensitive actions and isolating agentic browsing. In a later post (22 October 2025) that does not mention this report, Perplexity said Comet marks external content as untrusted in prompts, runs classifier checks on new content before acting and pauses for the user's confirmation before actions such as sending an email or making account changes",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE",
    "REGISTER",
    "PPLX-MITIGATE"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "Coordinated disclosure between competitors",
   "assertion_type": "assertion",
   "source_ids": [
    "BRAVE"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  }
 ],
 "controls": {
  "failed": [
   {
    "id": "C-I1",
    "note": "Content-instruction separation",
    "confidence": "high",
    "basis": "curated"
   },
   {
    "id": "C-E1",
    "note": "Session scoping; Per-task isolation of logged-in sessions (absent)",
    "confidence": "high",
    "basis": "curated"
   }
  ],
  "succeeded": [
   {
    "id": "C-O1",
    "note": "Disclosure, albeit by a competitor",
    "confidence": "high",
    "basis": "curated"
   }
  ],
  "absent": []
 },
 "applicable_rules": [
  "None agent-specific"
 ],
 "unmapped": [],
 "corrections": [
  {
   "date": "2026-10-13",
   "field": "controls.C-E1",
   "old": "failed: Session scoping; absent: Per-task isolation of logged-in sessions",
   "new": "failed: Session scoping; Per-task isolation of logged-in sessions (absent)",
   "reason": "a control has one state per case; entries in two states merged into the state the record supports"
  },
  {
   "date": "2026-10-13",
   "field": "context.jurisdiction",
   "old": "Global (vendor | competing vendor as researcher)",
   "new": "Global (vendor, competing vendor as researcher)",
   "reason": "jurisdiction text was split at a comma inside parentheses"
  },
  {
   "date": "2026-10-13",
   "field": "fields and sources",
   "old": "'later fixes followed'; 'vendor statements'",
   "new": "timeline as the researcher records it, including its post-publication note that mitigation was incomplete; no vendor statement linked",
   "reason": "claims aligned to what each linked record says, found on review"
  },
  {
   "date": "2026-10-14",
   "field": "reviewed_by",
   "old": "none",
   "new": "Saurabh Bhatnagar (editor)",
   "reason": "case checked by the editor against its linked records"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[Brave].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to press@brave.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[Perplexity].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to press@perplexity.ai on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-16",
   "field": "inference.value",
   "old": "The commerce-side version of EchoLeak, with the user's sessions as the authority at stake; the Register notes the researcher's interest and does not lower confidence in the mechanism, which the vendor acknowledged",
   "new": "The shopping-agent version of EchoLeak, with the user's signed-in sessions as the authority at stake. The researchers work for a competing browser maker; the vendor acknowledged the mechanism, so the Register does not lower its confidence in it.",
   "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged"
  },
  {
   "date": "2026-10-16",
   "field": "inference.value",
   "old": "The shopping-agent version of EchoLeak, with the user's signed-in sessions as the authority at stake. The researchers work for a competing browser maker; the vendor acknowledged the mechanism, so the Register does not lower its confidence in it.",
   "new": "The browsing-agent version of EchoLeak, with the user's signed-in sessions as the authority at stake. The researchers work for a competing browser maker, which readers should weigh.",
   "reason": "Found in an outside review of the published record on 16 October 2026: the interpretation said the vendor acknowledged the mechanism, but the vendor's statement is not in this record"
  },
  {
   "date": "2026-10-16",
   "field": "family",
   "old": "transaction",
   "new": "software",
   "reason": "Found in an outside review of the published record on 16 October 2026: no money moved; the harm demonstrated was a leak of the user's credentials, so the case belongs with software agents"
  },
  {
   "date": "2026-10-20",
   "field": "sources.DECRYPT",
   "old": null,
   "new": "{\"title\": \"Perplexity Comet Flaw Exposed User Data to Attackers, Brave Reports (Decrypt, Jason Nelson)\", \"type\": \"press_pointer\", \"url\": \"https://decrypt.co/336763/perplexity-comet-flaw-exposed-user-data-attackers-brave-reports\", \"via_press\": true, \"date\": \"2025-08-25\", \"tier\": \"disclosure_corroborated\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: Decrypt carries Perplexity's response to the Brave disclosure (a spokesperson said the issue 'was patched before anyone noticed', that no user data was compromised and that Perplexity 'worked directly with Brave', and Perplexity disputed the severity); Perplexity's statement is not available in its original form, so this press copy is the record of it"
  },
  {
   "date": "2026-10-20",
   "field": "sources.REGISTER",
   "old": null,
   "new": "{\"title\": \"Perplexity's Comet browser naively processed pages with evil instructions (The Register, Thomas Claburn)\", \"type\": \"press_pointer\", \"url\": \"https://www.theregister.com/2025/08/20/perplexity_comet_browser_prompt_injection/\", \"via_press\": true, \"date\": \"2025-08-20\", \"tier\": \"disclosure_corroborated\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: The Register reports Brave's same-day update (added 2145 GMT, 20 August 2025) and a Brave spokesperson's statement that Perplexity did not share the patch and the browser's code is not open source"
  },
  {
   "date": "2026-10-20",
   "field": "sources.PPLX-MITIGATE",
   "old": null,
   "new": "{\"title\": \"Mitigating Prompt Injection in Comet (Perplexity Security Team)\", \"type\": \"company\", \"url\": \"https://www.perplexity.ai/hub/blog/mitigating-prompt-injection-in-comet\", \"via_press\": false, \"date\": \"2025-10-22\", \"tier\": \"disclosure_corroborated\", \"interest\": \"vendor describing its own product\", \"primary\": true, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: Perplexity's own post, dated 22 October 2025 on the page, describes Comet's prompt-injection mitigations; it does not mention Brave or the August report"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. Reported 25 July 2025; Perplexity's first fix came two days later and the researcher found it incomplete; the issue appeared patched by 13 August; after publication Brave said the attack still had not been fully mitigated.",
   "new": "State: averted by disclosure. Reported 25 July 2025; Perplexity's first fix came two days later and the researcher found it incomplete; Brave sent Perplexity a one-week public-disclosure notice on 11 August; the issue appeared patched by 13 August; after publishing on 20 August, Brave added that Perplexity 'still hasn't fully mitigated the kind of attack described here' and that it had re-reported the issue. Perplexity's account differs: a spokesperson told Decrypt the issue 'was patched before anyone noticed' and that no user data was compromised, and Perplexity disputed the severity of the finding.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Brave post's timeline also records 'August 11, 2025: One-week public disclosure notice sent to Perplexity', and its update says 'after this blog post was released, we learned that Perplexity still hasn't fully mitigated the kind of attack described here. We've re-reported this to them'; Decrypt (25 August 2025) reports that 'Perplexity disputed the severity of the finding' and that a spokesperson said the issue 'was patched before anyone noticed' and no user data was compromised. The two accounts disagree, so both are stated and the field is marked disputed (runbook rule 16)"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Outcome.disputed",
   "old": "false",
   "new": "true",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: Brave says the attack was not fully mitigated; Perplexity says it was patched (Brave post; Decrypt, 25 August 2025)"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Outcome.source_ids",
   "old": "[\"BRAVE\"]",
   "new": "[\"BRAVE\", \"DECRYPT\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: new source DECRYPT carries Perplexity's account"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Evidence event",
   "old": "Researcher disclosure with demonstration and a dated timeline; note that the researcher sells a competing browser. Perplexity's own statement is not in this record",
   "new": "Researcher disclosure with demonstration and a dated timeline; note that the researcher makes a competing browser and is building agentic browsing for its own assistant, Leo. Perplexity's statement is not in the Brave post; to the press, a Perplexity spokesperson said the issue was patched before anyone noticed, that no user data was compromised and that Perplexity worked directly with Brave, and Perplexity disputed the severity of the finding",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: Brave's browser is free, so 'sells' was loose; the Brave post says 'we're developing the ability for our in-browser AI assistant Leo to browse the Web on your behalf'. 'Perplexity's own statement is not in this record' was out of date: Decrypt (25 August 2025) quotes a Perplexity spokesperson: 'We worked directly with Brave to identify and repair it'"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Evidence event.source_ids",
   "old": "[\"BRAVE\"]",
   "new": "[\"BRAVE\", \"DECRYPT\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: new source DECRYPT carries Perplexity's statement"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Recovery technical",
   "old": "Patches; separation of page content from instructions",
   "new": "Patches: an initial fix on 27 July, found incomplete on retest, and a fix that appeared to work by 13 August; a Brave spokesperson said Perplexity did not share the patch, and the sources do not say what it changed. Separating page content from the user's instructions is Brave's recommendation, alongside checking actions against the user's request, asking the user to confirm sensitive actions and isolating agentic browsing. In a later post (22 October 2025) that does not mention this report, Perplexity said Comet marks external content as untrusted in prompts, runs classifier checks on new content before acting and pauses for the user's confirmation before actions such as sending an email or making account changes",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Brave post lists separating page content from instructions as a recommendation ('The browser should clearly separate the user's instructions from the website's contents'), not as a step Perplexity took; The Register (20 August 2025) reports that 'a Brave spokesperson said Perplexity did not share the patch'. Perplexity's own post 'Mitigating Prompt Injection in Comet' (22 October 2025) says 'External content is demarcated as untrusted in prompts' and describes classifier checks and user confirmation for sensitive actions"
  },
  {
   "date": "2026-10-20",
   "field": "fields.Recovery technical.source_ids",
   "old": "[\"BRAVE\"]",
   "new": "[\"BRAVE\", \"REGISTER\", \"PPLX-MITIGATE\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: new sources REGISTER (patch not shared) and PPLX-MITIGATE (vendor's described mitigations)"
  },
  {
   "date": "2026-10-20",
   "field": "inference.value",
   "old": "The browsing-agent version of EchoLeak, with the user's signed-in sessions as the authority at stake. The researchers work for a competing browser maker, which readers should weigh.",
   "new": "The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email, the attack ran only after the user asked Comet to summarize the attacker's page. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the Brave post does not mention EchoLeak, so the comparison is the Secure Autonomous Register's own cross-reference; it skipped a difference the record shows: the user 'asks Comet to summarize' the Reddit post carrying the hidden instructions, whereas EchoLeak (REG-0021) needed no user action on the attacker's email. The interpretation now also says what the record does not show (a Brave spokesperson told The Register the patch was not shared) and that Brave ('still hasn't fully mitigated') and Perplexity ('was patched before anyone noticed', per Decrypt) disagree. The interpretation was unsigned (signed_by null); the editor signs the new wording"
  },
  {
   "date": "2026-10-20",
   "field": "inference.source_ids",
   "old": "[\"BRAVE\"]",
   "new": "[\"BRAVE\", \"REGISTER\", \"DECRYPT\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the interpretation now cites the patch not being shared (REGISTER) and Perplexity's account (DECRYPT)"
  },
  {
   "date": "2026-10-20",
   "field": "outcome.as_of",
   "old": "Aug 2025",
   "new": "Oct 2025",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the record now runs to Perplexity's 22 October 2025 post describing Comet's prompt-injection mitigations (PPLX-MITIGATE); a search for later rulings, regulator action or further statements on this report found none"
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email, the attack ran only after the user asked Comet to summarize the attacker's page. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh.",
   "new": "The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email and were picked up when the user asked Copilot an ordinary question, the attack ran only after the user asked Comet to summarize a page carrying the attacker's hidden instructions. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the page was a Reddit post carrying the attacker's comment, on a site Brave says the attacker 'doesn't control' (Brave), not the attacker's page; EchoLeak also ran only after the user asked Copilot a question (BleepingComputer; REG-0021's Mandate field)."
  },
  {
   "date": "2026-10-21",
   "field": "inference.signed_by",
   "old": "Saurabh Bhatnagar",
   "new": null,
   "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Perplexity].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)\"], \"note\": null}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)\"}]}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Brave].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest\"], \"note\": null}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest\"}]}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-28",
   "field": "named_parties[Perplexity].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)\"}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)\"}], \"no_response_as_of\": \"2026-10-28\"}",
   "reason": "right of reply recorded by a human"
  },
  {
   "date": "2026-10-28",
   "field": "named_parties[Brave].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest\"}]}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest\"}], \"no_response_as_of\": \"2026-10-28\"}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-06",
 "last_reviewed": "2026-10-28",
 "actor_status": "confirmed",
 "provenance_tier_text": "Researcher disclosure by a competitor; vendor patches",
 "status_text": "Confirmed (demonstrated); researcher is an interested party",
 "outcome": {
  "state": "averted_by_disclosure",
  "severity": "none (demonstration)",
  "affected_parties": [],
  "cost": "none",
  "regime_consequence": "vendor patches",
  "as_of": "Oct 2025",
  "derived_by": "backfill-curated"
 },
 "inference": {
  "value": "The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email and were picked up when the user asked Copilot an ordinary question, the attack ran only after the user asked Comet to summarize a page carrying the attacker's hidden instructions. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh.",
  "source_ids": [
   "BRAVE",
   "REGISTER",
   "DECRYPT"
  ],
  "confidence": "high",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "named_parties": [
  {
   "name": "Perplexity",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [
       "a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)"
      ],
      "note": null
     }
    ],
    "followups": [
     {
      "sent": "2026-10-22",
      "covers": "a Brave spokesperson says Perplexity did not share the patch, and the record does not show what it changed (Recovery technical, interpretation)"
     }
    ],
    "no_response_as_of": "2026-10-28"
   }
  },
  {
   "name": "Brave",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [
       "the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest"
      ],
      "note": null
     }
    ],
    "followups": [
     {
      "sent": "2026-10-22",
      "covers": "the interpretation dropped 'does not lower confidence in the mechanism' and now tells readers to weigh Brave's competing interest"
     }
    ],
    "no_response_as_of": "2026-10-28"
   }
  }
 ],
 "sources": {
  "BRAVE": {
   "title": "Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib)",
   "type": "researcher",
   "url": "https://brave.com/blog/comet-prompt-injection/",
   "via_press": false,
   "date": "2025-08-20",
   "tier": "disclosure_corroborated",
   "interest": "competitor of the vendor",
   "primary": true,
   "checked": "2026-10-20"
  },
  "DECRYPT": {
   "title": "Perplexity Comet Flaw Exposed User Data to Attackers, Brave Reports (Decrypt, Jason Nelson)",
   "type": "press_pointer",
   "url": "https://decrypt.co/336763/perplexity-comet-flaw-exposed-user-data-attackers-brave-reports",
   "via_press": true,
   "date": "2025-08-25",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  },
  "REGISTER": {
   "title": "Perplexity's Comet browser naively processed pages with evil instructions (The Register, Thomas Claburn)",
   "type": "press_pointer",
   "url": "https://www.theregister.com/2025/08/20/perplexity_comet_browser_prompt_injection/",
   "via_press": true,
   "date": "2025-08-20",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  },
  "PPLX-MITIGATE": {
   "title": "Mitigating Prompt Injection in Comet (Perplexity Security Team)",
   "type": "company",
   "url": "https://www.perplexity.ai/hub/blog/mitigating-prompt-injection-in-comet",
   "via_press": false,
   "date": "2025-10-22",
   "tier": "disclosure_corroborated",
   "interest": "vendor describing its own product",
   "primary": true,
   "checked": "2026-10-20"
  }
 },
 "derived_by": "backfill-curated",
 "reviewed_by": "Saurabh Bhatnagar (editor)"
}