Is Perplexity Comet Safe? LayerX Finds a Prompt Injection Attack Vector

New research by LayerX shows how a single weaponized URL, without any malicious page content, is enough to let an attacker steal any sensitive data that has been exposed in the Comet browser. 

For example, if the user asked Comet to rewrite an email or schedule an appointment, the email content and meeting metadata can be exfiltrated to the attacker.

An attacker only needs to get a user to open a crafted link, which can be sent via email, an extension, or a malicious site, and sensitive Comet data can be exposed, extracted, and exfiltrated.

Imagine your web browser is more than a window to the internet: it’s a personal assistant with trusted access to your email, calendar, and documents. Now, imagine a hacker could hijack that assistant with a single malicious link, turning your trusted co-pilot into a spy that steals your data.

This isn’t a hypothetical scenario. LayerX security researchers have discovered a critical vulnerability in Perplexity’s new AI-powered Comet browser that does exactly that. This finding reveals a new type of threat unique to AI-native browsers, where the risk goes beyond simple data theft to the complete hijacking of the AI itself.

To understand the risk, think of a modern AI browser like a digital butler. Some butlers can only talk to you – they can summarize a web page or explain a complex topic. But a new class of “agentic” browser, like Perplexity’s Comet, is a butler you can give the keys to your digital life. You can authorize it to access your Gmail or Google Calendar to perform tasks on your behalf, like drafting emails or scheduling meetings.

The danger lies in slipping this powerful butler a secret, malicious note hidden in plain sight. This is the essence of the vulnerability: an attacker can craft a seemingly normal web link that contains hidden instructions. When the browser’s AI reads these instructions, it bypasses its primary user and begins taking orders directly from the attacker.

The attack we discovered is alarmingly simple for the victim, but sophisticated behind the scenes. It turns a simple web link into a weapon that executes a five-step heist.

There are a few things in this attack that make it unique: in Perplexity, it is possible to initiate a conversation using a view URL. This works by concatenating the query into the URL itself, which allows asking questions while also enabling access to personal data defined by the user. By manipulating the URL parameters, it is possible to force Perplexity to treat the user’s memory as the primary source of information. This behavior can significantly expand the exposure of private data.

Because Perplexity’s AI browser can integrate with connectors such as Gmail or Calendar, any action performed through the assistant may expose sensitive personal data. For example, this could include the content of an email it helped compose or the details of an appointment it scheduled. This dramatically expands the potential attack surface, as a malicious actor could manipulate the system to gain access to highly sensitive information.

Therefore, an attacker could attempt to exfiltrate sensitive information by instructing the assistant to generate Python code that transmits results to a remote server. While Perplexity applies safeguards to block the direct sending of sensitive data, these protections can be bypassed through trivial transformations. 

To prevent exfiltration of sensitive user information, Perplexity enforces a strict separation between page data and user memory: routine AI interactions such as summarizing page content or drafting messages operate only on page data, while user memory stores sensitive personal information like credentials and passwords. 

While Perplexity implements safeguards to prevent the direct exfiltration of sensitive user memory, those protections do not address cases where data is deliberately obfuscated or encoded before leaving the browser. 

In LayerX’s proof-of-concept test, we demonstrated that exporting sensitive fields in an encoded form (base64) effectively circumvented the platform’s exfiltration checks, allowing the encoded payload to be transferred without triggering the existing safeguards.

To prove this wasn’t just a theory, we put it to the test. Our team developed several proof-of-concept (PoC) attacks that demonstrate the real-world risk:

• Email Theft: We crafted a link that, when clicked, commanded the AI to access the user’s connected email account, copy all messages, and send them to our server.

This discovery is more than just another bug; it represents a fundamental shift in the browser attack surface.

For years, attackers focused on tricking users into giving up their credentials through phishing pages. But with agentic browsers, they no longer need the user’s password—they just need to hijack the agent that is already logged in. The browser itself becomes a potential insider threat. The risk moves from passive data theft to active command execution, fundamentally changing how security teams must defend their organizations.

In an enterprise environment, a single click could allow an attacker to gain a foothold, move laterally across systems, and manipulate corporate communication channels, all under the guise of a legitimate user’s activity.

LayerX submitted its findings to Perplexity under Responsible Disclosure guidelines on 27 August, 2025. Perplexity replied that it could not identify any security impact, and therefore marked it as Not Applicable.

The LayerX team’s findings reveal that while AI-native browsers like Comet are innovative, their agentic nature makes them a powerful new target for attackers. The convenience of an AI assistant comes with the risk of an AI adversary.

Security leaders must recognize that AI browsers are the next frontier for cyberattacks. It is crucial to begin evaluating protective measures that can detect and neutralize malicious AI prompts before these proof-of-concept exploits become widespread, active campaigns.