Loading story…
A novel agentic browser attack has been demonstrated against Perplexity's Comet browser, allowing attackers to delete the entire contents of a user's Google Drive through a zero-click technique. By leveraging the browser's integration with Gmail and Google Drive, and exploiting the excessive autonomy of LLM-powered assistants, attackers can send specially crafted emails containing natural language instructions. These instructions are interpreted as legitimate housekeeping tasks, resulting in the deletion of critical files without user confirmation, provided the agent has OAuth access to the relevant Google services.
Separately, the Predator spyware, developed by Intellexa, has adopted a new zero-click infection vector called "Aladdin," which delivers malware via malicious advertisements. This method targets specific individuals by serving weaponized ads through commercial ad networks, requiring only that the target views the ad for infection to occur. The infrastructure supporting this attack is distributed across multiple countries and leverages complex ad delivery mechanisms, making detection and attribution challenging. Both incidents highlight the growing sophistication and diversity of zero-click attack techniques targeting both browser automation and mobile devices.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Cato Networks revealed the 'HashJack' technique, which hides malicious prompts in URL fragments to indirectly manipulate AI browser assistants. The disclosure noted that Perplexity and Microsoft patched affected browsers, while Google classified the issue as low severity and declined to fix it.
Researchers at Straiker STAR Labs found that a crafted email could abuse Perplexity's Comet browser integrations with Gmail and Google Drive to trigger deletion of a user's Google Drive without prompt injection or jailbreaks. The attack used natural-language instructions framed as legitimate housekeeping tasks, exposing a new zero-click risk in agentic browsers.
A joint investigation by Inside Story, Haaretz, and WAV Research Collective, corroborated by Amnesty International, Google, and Recorded Future, publicly detailed the Aladdin zero-click ad-based infection vector used by Predator spyware. The disclosure also highlighted leaked documents and prior research tying Intellexa to extensive zero-day exploitation.
Reporting cited in the reference says the Aladdin infection infrastructure and operations were still believed to be active as of 2024, despite sanctions and investigations into Intellexa. Researchers also identified additional Predator delivery vectors including 'Triton,' 'Thor,' and 'Oberon.'
Predator spyware operator Intellexa used a zero-click infection vector codenamed 'Aladdin' that infected targets when they viewed weaponized mobile ads delivered through commercial advertising networks. The campaign relied on identifiers such as public IP addresses to target victims and used infrastructure spread across multiple countries and shell companies to obscure operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new attack technique called **CometJacking** has been identified, targeting Perplexity's Comet AI browser through prompt injection via URL parameters. By embedding malicious instructions in the `collection` parameter of a URL, attackers can direct the AI agent to access and exfiltrate sensitive data from connected services such as Gmail and Google Calendar, without requiring user credentials or interaction. LayerX researchers demonstrated that the AI browser could be manipulated to encode and send confidential information to an external endpoint, bypassing existing security checks and highlighting a fundamental vulnerability in current LLM-based systems. The rise of AI-driven browsers and generative AI tools in the enterprise environment has significantly increased the risk of data exfiltration, with copy-paste actions into AI prompts now surpassing traditional file transfers as the primary vector for corporate data leaks. According to LayerX's Browser Security Report 2025, 77% of employees paste data into AI prompts, and a substantial portion of this activity occurs through personal accounts, making governance and monitoring more challenging. The report underscores the urgent need for organizations to implement stricter controls over AI tool usage, monitor clipboard and prompt activity for sensitive data, and adapt data loss prevention strategies to address the evolving threat landscape posed by AI-enabled browsers and prompt injection attacks like CometJacking.
Jun 29, 2026
Security researchers at LayerX have identified a critical security weakness in the Comet AI browser developed by Perplexity, which is susceptible to a novel prompt injection attack dubbed 'CometJacking.' The vulnerability allows attackers to craft malicious URLs that, when processed by the Comet browser, inject hidden instructions capable of accessing sensitive data from connected services such as email and calendar applications. The attack does not require user credentials or direct interaction, making it particularly dangerous and easy to exploit. By embedding malicious prompts in web pages, comment sections, or even code accessed by the browser, cybercriminals can instruct Comet to exfiltrate data residing in memory or accessible through its integrations. For example, if a user asks Comet to rewrite an email or schedule a meeting, the browser could be manipulated to extract and transmit the content and metadata of those communications to an external server controlled by the attacker. LayerX demonstrated a proof of concept where the browser was instructed to encode sensitive data in base64 and send it to a remote endpoint, successfully bypassing Perplexity's existing safeguards. The browser's agentic AI capabilities, which allow it to autonomously perform tasks like managing emails, shopping, and booking tickets, increase the potential impact of this vulnerability. Despite being notified of the issue in late August, Perplexity responded that the reported weakness was 'not applicable' and considered it beyond their control to remediate. Security experts warn that the rapid adoption of the Comet browser, combined with its integration with various personal and enterprise services, amplifies the risk of widespread data exfiltration if the vulnerability is exploited in the wild. The attack leverages the 'collection' parameter in the URL query string to deliver the malicious prompt, instructing the AI agent to consult its memory and connected services rather than simply searching the web. This method allows attackers to bypass direct data transmission restrictions implemented by Perplexity, as the AI agent itself is manipulated to perform the exfiltration. The vulnerability highlights the broader risks associated with agentic AI browsers that have deep integrations with user data and services. Security researchers emphasize the need for more robust safeguards and prompt injection defenses in AI-powered browsers to prevent similar attacks. The incident also raises questions about vendor responsibility and the challenges of securing AI-driven automation tools. Organizations using the Comet browser are advised to review their security posture and consider the risks of integrating sensitive services with agentic AI tools. The case underscores the importance of continuous security assessment and responsible disclosure in the rapidly evolving landscape of AI-powered applications. As the CometJacking technique requires only a crafted URL, it could be weaponized in phishing campaigns or embedded in seemingly innocuous web content, increasing the attack surface for potential victims. The ongoing debate between researchers and the vendor over the severity and remediability of the issue further complicates the response and mitigation efforts.
Jul 12, 2026
Zenity disclosed zero-click attacks that hijacked **OpenAI’s ChatGPT Atlas** and **Anthropic’s Claude in Chrome** by embedding malicious instructions in content the agents were allowed to read, including X posts and email messages. In the Atlas demonstrations, a planted X comment exploited **intent collision** to redirect a benign task into phishing messages sent from the victim’s authenticated **WhatsApp Web** session, and a separate chain steered Atlas into making an unauthorized **Amazon** purchase by abusing Amazon’s **Rufus** assistant to finish the order. Researchers said Atlas’s prompt-based guardrails and classifiers could be bypassed by distributing instructions across page elements, using alternate language text, and making the malicious action appear aligned with the user’s original goal. A parallel attack against **Claude in Chrome** used indirect prompt injection in an email and a rogue `NPM` package served from a malicious CDN to escalate into JavaScript execution inside the victim’s active browser sessions. Zenity said the chain enabled Gmail inbox theft, persistent Google Drive sharing abuse, and takeover of **Slack**, **X**, and **Claude.ai** accounts by intercepting verification codes from Gmail. The findings were framed as an architectural risk in agentic browsers that can act across authenticated sessions, effectively recreating **CSRF-like cross-origin abuse** at the AI agent layer; Zenity said it reported the Atlas issues to OpenAI and the Claude issues to Anthropic months earlier, but the attacks remained exploitable or were treated as informational at publication time.
Aug 7, 2026