Loading story…
Researchers at Cato Networks have identified a new attack technique called HashJack, which leverages the fragment portion of URLs (the section after the # symbol) to hide malicious prompts. This method specifically targets AI browser assistants such as Copilot in Edge, Gemini in Chrome, and Comet from Perplexity AI. When users interact with these AI-powered browsers, the hidden instructions in the URL fragment are processed by the large language model, potentially leading to outcomes like data exfiltration, phishing, misinformation, malware guidance, or even harmful medical advice. Traditional network and server-side defenses are unable to detect these attacks because URL fragments are never transmitted beyond the client, making legitimate websites unwitting vectors for exploitation.
The HashJack attack is a form of indirect prompt injection, where attackers craft links to trusted sites with appended malicious instructions after the # symbol. Unsuspecting users who click these links and then use their AI browser assistant may trigger the hidden prompts, which can manipulate the assistant to perform harmful actions or leak sensitive data. The risk is heightened in agentic AI browsers, where the assistant may autonomously send user data to attacker-controlled endpoints. Security researchers warn that this technique can weaponize any legitimate website, underscoring the urgent need for improved defenses in AI browser architectures against prompt injection threats.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Multiple outlets reported Cato's public disclosure of HashJack, describing how URL fragments on legitimate sites could be weaponized to trigger phishing, misinformation, malware delivery, or data exfiltration through AI browser assistants. The disclosure highlighted that traditional network and server-side defenses are ineffective because the malicious content remains client-side.
Following disclosure, Microsoft and Perplexity implemented fixes to address HashJack-related abuse in Copilot for Edge and Comet. Reports indicate Google did not issue a fix and instead treated the behavior as intended.
Cato notified vendors about the HashJack issue after validating the technique against multiple AI browser assistants. Google was informed but classified the behavior as low severity or intended behavior rather than a security vulnerability.
Cato CTRL researchers identified a new indirect prompt injection method, dubbed HashJack, that hides malicious instructions in URL fragments to manipulate AI browser assistants. Testing showed successful exploitation against Perplexity Comet, Microsoft Copilot for Edge, and Google Gemini for Chrome, while Claude for Chrome and OpenAI Atlas/Operator were not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourcecsoonline.com
Open sourcego.theregister.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at LayerX have identified a critical security weakness in the Comet AI browser developed by Perplexity, which is susceptible to a novel prompt injection attack dubbed 'CometJacking.' The vulnerability allows attackers to craft malicious URLs that, when processed by the Comet browser, inject hidden instructions capable of accessing sensitive data from connected services such as email and calendar applications. The attack does not require user credentials or direct interaction, making it particularly dangerous and easy to exploit. By embedding malicious prompts in web pages, comment sections, or even code accessed by the browser, cybercriminals can instruct Comet to exfiltrate data residing in memory or accessible through its integrations. For example, if a user asks Comet to rewrite an email or schedule a meeting, the browser could be manipulated to extract and transmit the content and metadata of those communications to an external server controlled by the attacker. LayerX demonstrated a proof of concept where the browser was instructed to encode sensitive data in base64 and send it to a remote endpoint, successfully bypassing Perplexity's existing safeguards. The browser's agentic AI capabilities, which allow it to autonomously perform tasks like managing emails, shopping, and booking tickets, increase the potential impact of this vulnerability. Despite being notified of the issue in late August, Perplexity responded that the reported weakness was 'not applicable' and considered it beyond their control to remediate. Security experts warn that the rapid adoption of the Comet browser, combined with its integration with various personal and enterprise services, amplifies the risk of widespread data exfiltration if the vulnerability is exploited in the wild. The attack leverages the 'collection' parameter in the URL query string to deliver the malicious prompt, instructing the AI agent to consult its memory and connected services rather than simply searching the web. This method allows attackers to bypass direct data transmission restrictions implemented by Perplexity, as the AI agent itself is manipulated to perform the exfiltration. The vulnerability highlights the broader risks associated with agentic AI browsers that have deep integrations with user data and services. Security researchers emphasize the need for more robust safeguards and prompt injection defenses in AI-powered browsers to prevent similar attacks. The incident also raises questions about vendor responsibility and the challenges of securing AI-driven automation tools. Organizations using the Comet browser are advised to review their security posture and consider the risks of integrating sensitive services with agentic AI tools. The case underscores the importance of continuous security assessment and responsible disclosure in the rapidly evolving landscape of AI-powered applications. As the CometJacking technique requires only a crafted URL, it could be weaponized in phishing campaigns or embedded in seemingly innocuous web content, increasing the attack surface for potential victims. The ongoing debate between researchers and the vendor over the severity and remediability of the issue further complicates the response and mitigation efforts.
Jul 12, 2026
A new attack technique called **CometJacking** has been identified, targeting Perplexity's Comet AI browser through prompt injection via URL parameters. By embedding malicious instructions in the `collection` parameter of a URL, attackers can direct the AI agent to access and exfiltrate sensitive data from connected services such as Gmail and Google Calendar, without requiring user credentials or interaction. LayerX researchers demonstrated that the AI browser could be manipulated to encode and send confidential information to an external endpoint, bypassing existing security checks and highlighting a fundamental vulnerability in current LLM-based systems. The rise of AI-driven browsers and generative AI tools in the enterprise environment has significantly increased the risk of data exfiltration, with copy-paste actions into AI prompts now surpassing traditional file transfers as the primary vector for corporate data leaks. According to LayerX's Browser Security Report 2025, 77% of employees paste data into AI prompts, and a substantial portion of this activity occurs through personal accounts, making governance and monitoring more challenging. The report underscores the urgent need for organizations to implement stricter controls over AI tool usage, monitor clipboard and prompt activity for sensitive data, and adapt data loss prevention strategies to address the evolving threat landscape posed by AI-enabled browsers and prompt injection attacks like CometJacking.
Jun 29, 2026
Security researchers reported that **prompt injection** is enabling practical attacks against *agentic AI* systems that have access to tools and user data, and argued the industry is underestimating the threat. A proposed framing, **“promptware,”** describes malicious prompts as a malware-like execution mechanism that can drive an LLM to take actions via its connected tools—potentially leading to **data exfiltration**, cross-system propagation, IoT manipulation, or even **arbitrary code execution**, depending on the permissions and integrations available. Trail of Bits disclosed results from an adversarial security assessment of Perplexity’s *Comet* browser, showing how prompt injection techniques could be used to **extract private information from authenticated sessions (e.g., Gmail)** by abusing the browser’s AI assistant and its tool access (such as reading page content, using browsing history, and interacting with the browser). Their threat-model-driven testing emphasized that agentic assistants can treat external web content as instructions unless it is explicitly handled as **untrusted input**, and they published recommendations intended to reduce prompt-injection-driven data paths between the user’s local trust zone (profiles/cookies/history) and vendor-hosted agent/chat services.
Jul 3, 2026