Brave researchers disclose indirect prompt injection flaw in Perplexity's Comet browser
Brave said it reported the flaw on 25 July and Perplexity's fix was incomplete on retesting; the underlying weakness reportedly remained after disclosure.
- Security & misuse
- Notable
Researchers at Brave disclosed an indirect prompt-injection vulnerability in Perplexity’s Comet browser, an AI-agentic browser that had launched earlier in 2025. When a user asked Comet to summarise a webpage, the browser fed a portion of the page directly to its underlying language model without distinguishing the user’s own instructions from untrusted content embedded in the page itself. Brave showed that instructions hidden on a page — in white-on-white text or HTML comments invisible to a human reader — would be read and followed by Comet’s assistant as if the user had typed them.
In a proof-of-concept, Brave’s researchers used this to have Comet navigate to a user’s Perplexity account page, retrieve login information, and then access a connected Gmail inbox — where the user was already signed in — to fetch a one-time password, before exfiltrating both the email address and the code to a comment on a Reddit thread controlled by the attacker. The demonstration required no click beyond the original “summarise this page” request.
Brave said it reported the flaw to Perplexity on 25 July; Perplexity acknowledged it and shipped a fix two days later, but Brave’s retesting on 28 July found the fix incomplete, prompting a further round before Brave gave a week’s public-disclosure notice and published on 20 August. A later update to Brave’s post noted that Perplexity had still not fully closed the underlying attack class described in the report.
The disclosure was an early, concrete demonstration of a structural problem that would recur across the new category of browser agents through the rest of 2025: an AI system reading a webpage cannot reliably tell a user’s instruction apart from an instruction planted in the page’s content. The same class of vulnerability was later reported in OpenAI’s Atlas browser days after its October launch, reinforcing that the risk was inherent to giving a model the ability to act on pages it reads, not a defect specific to one product.