Perplexity Comet: a web page steers a browsing agent toward the user's own credentials, disclosed August 2025
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | A user asking the agent to summarize a page | assertion downgraded by verifier | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) | high |
| Actor | The Comet browsing agent, holding the user's logged-in sessions | assertion downgraded by verifier | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) | high |
| Inputs | Hidden instructions in page content, including a comment on a public forum | assertion | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) | high |
| Decision | The agent treated page text as instructions, navigated to the user's account and email, and read a one-time code | assertion | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) | high |
| Envelope: authority | The agent carried every session the user had; nothing scoped it to the page being summarized | interpretation | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) | high |
| Action | Exfiltration of the user's email address and a one-time code via a post the attacker could read | assertion | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) | high |
| Outcome | State: averted by disclosure. Reported 25 July 2025; Perplexity's first fix came two days later and the researcher found it incomplete; Brave sent Perplexity a one-week public-disclosure notice on 11 August; the issue appeared patched by 13 August; after publishing on 20 August, Brave added that Perplexity 'still hasn't fully mitigated the kind of attack described here' and that it had re-reported the issue. Perplexity's account differs: a spokesperson told Decrypt the issue 'was patched before anyone noticed' and that no user data was compromised, and Perplexity disputed the severity of the finding. | assertion | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib); Perplexity Comet Flaw Exposed User Data to Attackers, Brave Reports (Decrypt, Jason Nelson) | medium |
| Evidence: event | Researcher disclosure with demonstration and a dated timeline; note that the researcher makes a competing browser and is building agentic browsing for its own assistant, Leo. Perplexity's statement is not in the Brave post; to the press, a Perplexity spokesperson said the issue was patched before anyone noticed, that no user data was compromised and that Perplexity worked directly with Brave, and Perplexity disputed the severity of the finding | interpretation | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib); Perplexity Comet Flaw Exposed User Data to Attackers, Brave Reports (Decrypt, Jason Nelson) | high |
| Recovery: technical | Patches: an initial fix on 27 July, found incomplete on retest, and a fix that appeared to work by 13 August; a Brave spokesperson said Perplexity did not share the patch, and the sources do not say what it changed. Separating page content from the user's instructions is Brave's recommendation, alongside checking actions against the user's request, asking the user to confirm sensitive actions and isolating agentic browsing. In a later post (22 October 2025) that does not mention this report, Perplexity said Comet marks external content as untrusted in prompts, runs classifier checks on new content before acting and pauses for the user's confirmation before actions such as sending an email or making account changes | assertion | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib); Perplexity's Comet browser naively processed pages with evil instructions (The Register, Thomas Claburn); Mitigating Prompt Injection in Comet (Perplexity Security Team) | medium |
| Recovery: accountability | Coordinated disclosure between competitors | assertion downgraded by verifier | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Content-instruction separation | C-I1 Retrieved content as data |
| failed | Session scoping; Per-task isolation of logged-in sessions (absent) | C-E1 Least-privilege credential scoped to task |
| succeeded | Disclosure, albeit by a competitor | C-O1 Coordinated disclosure program |
Inference
inference The browsing-agent counterpart of EchoLeak (REG-0021): text in content the agent read was carried out as instructions with the user's authority, here the user's signed-in sessions. Unlike EchoLeak, where the instructions arrived unasked in an email and were picked up when the user asked Copilot an ordinary question, the attack ran only after the user asked Comet to summarize a page carrying the attacker's hidden instructions. The record does not show what Perplexity's patches changed, and Brave and Perplexity disagree on whether the fix was complete. The researchers work for a competing browser maker, which readers should weigh.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| BRAVE | Brave: Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet (Artem Chaikin, Shivan Kaul Sahib) (interest: competitor of the vendor) | researcher primary record | brave.com ↗ checked 2026-10-20 |
| DECRYPT | Perplexity Comet Flaw Exposed User Data to Attackers, Brave Reports (Decrypt, Jason Nelson) | press pointer secondary: press report | decrypt.co ↗ checked 2026-10-20 |
| REGISTER | Perplexity's Comet browser naively processed pages with evil instructions (The Register, Thomas Claburn) | press pointer secondary: press report | theregister.com ↗ checked 2026-10-20 |
| PPLX-MITIGATE | Mitigating Prompt Injection in Comet (Perplexity Security Team) (interest: vendor describing its own product) | company primary record | perplexity.ai ↗ checked 2026-10-20 |