PerplexedBrowser (PleaseFix) Vulnerability Hijacks Perplexity Comet’s AI Agent via Calendar Invites

Security researchers at Zenity Labs disclosed PleaseFix, a family of critical vulnerabilities affecting agentic browsers—including Perplexity’s Comet—that enable AI agent hijacking via indirect prompt injection embedded in routine workflows. In the Comet-specific PerplexedBrowser variant, attackers can trigger unauthorized agent actions inside an authenticated user session, including local file access and data exfiltration, while the agent continues to behave normally from the user’s perspective, reducing the chance of detection.

One demonstrated attack uses a poisoned Google Calendar invite: hidden content (e.g., whitespace-obscured elements and a system_reminder-style instruction block) is processed when a user asks Comet’s agent to handle the invite, causing an “intent collision” where the agent merges the user’s request with attacker instructions. The payload can drive background navigation to attacker-controlled infrastructure, bypass language-focused guardrails by switching languages (e.g., Hebrew), coerce the agent into reading sensitive file:// resources (configuration files, API keys), and exfiltrate data by embedding it into outbound requests. A second exploit path described by Zenity Labs abuses agent-authorized workflows to manipulate password-manager interactions—potentially enabling credential theft (including from an unlocked 1Password session) and account takeover without directly exploiting the password manager itself.