EE
FR Contact

Hidden Reddit comment hijacks Perplexity's Comet browser agent to steal a login code

Proof of concept Manipulation Severity 3 significant Corroborated 87%

Brave researchers showed that instructions hidden behind a spoiler tag in a Reddit comment could take over Perplexity's Comet browser assistant when a user asked it to summarise the page. The agent fetched the user's email address from their Perplexity account, requested a one-time login code, read it from the user's logged-in Gmail and posted both in a reply to the comment, enabling account takeover. Perplexity issued fixes after Brave's July 2025 report, though Brave later said the attack class had not been fully mitigated.

Brave reported the flaw on 25 July 2025; an initial fix on 27 July proved incomplete, and testing on 13 August suggested it was patched. After publication, Brave said further testing showed Perplexity had not fully mitigated this kind of attack and re-reported it.

What would have stopped it

Isolate agentic browsing of untrusted pages from the user's authenticated sessions and confirm any cross-site action.

Guardrails

4 of 8 failed
  1. G1 Least privilege Failed While summarising an untrusted page, the agent could act with the user's logged-in sessions, including Gmail.
  2. G2 Human confirmation Failed The agent navigated, requested a login code and posted it without asking the user.
  3. G3 Isolation Failed Agentic browsing of an untrusted page was not separated from the user's authenticated accounts.
  4. G4 Instruction integrity Failed Comet treated hidden page text as instructions from the user.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 1 press
  1. Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet Brave, 20 Aug 2025
    “A user visits a Reddit post, with a comment containing the prompt injection instructions hidden behind the spoiler tag.”
    Primary Quote checked Archived copy
  2. Perplexity's Comet browser naively processed pages with evil instructions The Register, 20 Aug 2025
    “Chaikin and Sahib recount how they created a proof-of-concept attack consisting of malicious instructions posted to a Reddit page that were hidden behind a "spoiler" tag.”
    Press Quote checked Archived copy

Confidence 87% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 2 sources

Similar failures

All incidents
  1. EEAIR-2026-005 Feb 2026 Prompt injection in Cline's Claude issue-triage bot leads to an unauthorised npm release Claude Code GitHub Action, Anthropic 95%
  2. EEAIR-2026-037 Jul 2026 Noma Labs says Claude Code Desktop preview pane could leak local credentials Claude Code Desktop, AnthropicProof of concept 70%
  3. EEAIR-2025-044 Dec 2025 PromptPwnd: issue text can hijack AI agents in GitHub Actions to leak repository secrets AI agents in CI/CD workflows (Gemini CLI, Claude Code Actions, OpenAI Codex, GitHub AI Inference), Google; Anthropic; OpenAI; GitHubProof of conceptEU 92%