Loading story…
Security researchers at Zenity Labs disclosed PleaseFix, a family of critical vulnerabilities affecting agentic browsers—including Perplexity’s Comet—that enable AI agent hijacking via indirect prompt injection embedded in routine workflows. In the Comet-specific PerplexedBrowser variant, attackers can trigger unauthorized agent actions inside an authenticated user session, including local file access and data exfiltration, while the agent continues to behave normally from the user’s perspective, reducing the chance of detection.
One demonstrated attack uses a poisoned Google Calendar invite: hidden content (e.g., whitespace-obscured elements and a system_reminder-style instruction block) is processed when a user asks Comet’s agent to handle the invite, causing an “intent collision” where the agent merges the user’s request with attacker instructions. The payload can drive background navigation to attacker-controlled infrastructure, bypass language-focused guardrails by switching languages (e.g., Hebrew), coerce the agent into reading sensitive file:// resources (configuration files, API keys), and exfiltrate data by embedding it into outbound requests. A second exploit path described by Zenity Labs abuses agent-authorized workflows to manipulate password-manager interactions—potentially enabling credential theft (including from an unlocked 1Password session) and account takeover without directly exploiting the password manager itself.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Zenity Labs publicly disclosed the PleaseFix family of agentic browser vulnerabilities, including the PerplexedBrowser issues in Perplexity's Comet browser. The disclosure described zero-click and low-interaction attack paths using indirect prompt injection in routine content such as calendar invites to access local files and steal credentials within authenticated sessions.
As of 2026-02-13, Zenity confirmed that the demonstrated attacks against Comet, including local file exfiltration and related exploit paths, were no longer effective. Researchers noted, however, that broader agent-steering risks remain and some protections are opt-in.
Perplexity implemented a code-level hard boundary preventing the Comet agent from accessing local file paths via file://, along with other mitigations such as options to disable AI behavior on sensitive sites. Zenity later said this second patch closed the demonstrated local-file exfiltration path.
Zenity Labs responsibly disclosed the PerplexedBrowser/PleaseFix issues affecting Perplexity's Comet browser to Perplexity, with multiple reports placing the disclosure on 2025-10-22. Perplexity reportedly classified the issue as critical.
After the initial disclosure, Perplexity issued an initial patch for the Comet browser flaw, but researchers said the fix could be bypassed. The incomplete remediation led to a second round of patching to fully block the demonstrated file:// access path.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcevulnu.com
Open sourcetechrepublic.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at LayerX have identified a critical security weakness in the Comet AI browser developed by Perplexity, which is susceptible to a novel prompt injection attack dubbed 'CometJacking.' The vulnerability allows attackers to craft malicious URLs that, when processed by the Comet browser, inject hidden instructions capable of accessing sensitive data from connected services such as email and calendar applications. The attack does not require user credentials or direct interaction, making it particularly dangerous and easy to exploit. By embedding malicious prompts in web pages, comment sections, or even code accessed by the browser, cybercriminals can instruct Comet to exfiltrate data residing in memory or accessible through its integrations. For example, if a user asks Comet to rewrite an email or schedule a meeting, the browser could be manipulated to extract and transmit the content and metadata of those communications to an external server controlled by the attacker. LayerX demonstrated a proof of concept where the browser was instructed to encode sensitive data in base64 and send it to a remote endpoint, successfully bypassing Perplexity's existing safeguards. The browser's agentic AI capabilities, which allow it to autonomously perform tasks like managing emails, shopping, and booking tickets, increase the potential impact of this vulnerability. Despite being notified of the issue in late August, Perplexity responded that the reported weakness was 'not applicable' and considered it beyond their control to remediate. Security experts warn that the rapid adoption of the Comet browser, combined with its integration with various personal and enterprise services, amplifies the risk of widespread data exfiltration if the vulnerability is exploited in the wild. The attack leverages the 'collection' parameter in the URL query string to deliver the malicious prompt, instructing the AI agent to consult its memory and connected services rather than simply searching the web. This method allows attackers to bypass direct data transmission restrictions implemented by Perplexity, as the AI agent itself is manipulated to perform the exfiltration. The vulnerability highlights the broader risks associated with agentic AI browsers that have deep integrations with user data and services. Security researchers emphasize the need for more robust safeguards and prompt injection defenses in AI-powered browsers to prevent similar attacks. The incident also raises questions about vendor responsibility and the challenges of securing AI-driven automation tools. Organizations using the Comet browser are advised to review their security posture and consider the risks of integrating sensitive services with agentic AI tools. The case underscores the importance of continuous security assessment and responsible disclosure in the rapidly evolving landscape of AI-powered applications. As the CometJacking technique requires only a crafted URL, it could be weaponized in phishing campaigns or embedded in seemingly innocuous web content, increasing the attack surface for potential victims. The ongoing debate between researchers and the vendor over the severity and remediability of the issue further complicates the response and mitigation efforts.
Jul 12, 2026
A new attack technique called **CometJacking** has been identified, targeting Perplexity's Comet AI browser through prompt injection via URL parameters. By embedding malicious instructions in the `collection` parameter of a URL, attackers can direct the AI agent to access and exfiltrate sensitive data from connected services such as Gmail and Google Calendar, without requiring user credentials or interaction. LayerX researchers demonstrated that the AI browser could be manipulated to encode and send confidential information to an external endpoint, bypassing existing security checks and highlighting a fundamental vulnerability in current LLM-based systems. The rise of AI-driven browsers and generative AI tools in the enterprise environment has significantly increased the risk of data exfiltration, with copy-paste actions into AI prompts now surpassing traditional file transfers as the primary vector for corporate data leaks. According to LayerX's Browser Security Report 2025, 77% of employees paste data into AI prompts, and a substantial portion of this activity occurs through personal accounts, making governance and monitoring more challenging. The report underscores the urgent need for organizations to implement stricter controls over AI tool usage, monitor clipboard and prompt activity for sensitive data, and adapt data loss prevention strategies to address the evolving threat landscape posed by AI-enabled browsers and prompt injection attacks like CometJacking.
Jun 29, 2026
Security researchers and CERT/CC reporting highlighted **critical prompt-injection-to-execution paths** in agentic AI systems where untrusted content can be interpreted as instructions and then executed via connected tools. In *ModelScope MS-Agent*, **CVE-2026-2256** (CVSS 9.8) was reported as a **command injection / RCE** issue tied to the framework’s “Shell tool,” where external input is not properly sanitized before being passed to OS command execution; a `check_safe()` denylist-based filter was described as bypassable via obfuscation/alternate syntax, enabling arbitrary command execution and potential full host compromise. Separate research from **Zenity Labs** described a broader class of **agentic AI browser** weaknesses (including Perplexity’s *Comet*) where attackers can hijack autonomous workflows using indirect prompt injection delivered through normal channels such as a **calendar invite**; prior to patches, this could drive the browser to access local files, read directories/files, and exfiltrate data, and in some cases leverage the agent’s existing authenticated context to interact with sensitive services (including password managers). A similar execution-model risk was reported in *Langflow*’s CSV Agent as **CVE-2026-27966** (CVSS 10.0), where `allow_dangerous_code=True` was hardcoded, enabling LangChain’s `python_repl_ast` tool and allowing remote attackers with chat access to coerce **server-side code execution** and full system compromise via prompt injection.
Jun 29, 2026