Brave reveals how Perplexity's AI browser gets hijacked by a Reddit comment

If you are in the habit of letting AI summarize long articles while you grab a coffee, you might want to rethink that workflow. In an agentic browser, that innocent little click can hand over the keys to your entire digital life.

The Brave security team dropped a detailed breakdown of an indirect prompt injection vulnerability in Comet, Perplexity's AI-powered browser assistant. The takeaway is chilling: an attacker only needs to stash malicious text inside a public web page, and the moment you ask Comet to summarize it, the AI will happily browse over to your Gmail, grab your private login codes, and hand them over to the hacker.

How a Reddit comment hijacks an account

The root of the problem lies in the original sin of LLM security: indirect prompt injection.

When a user clicks "Summarize this webpage," Comet feeds portions of the page directly into its language model without separating the user's authentic command from the untrusted text on the screen. To a model, text is just text. If the webpage contains hidden instructions disguised as system prompts, the model treats them as fresh marching orders from the boss.

Brave security engineer Artem Chaikin built a proof-of-concept to show just how far this goes. In the demo, an attacker leaves a comment on Reddit hiding malicious instructions behind a spoiler tag.

A user lands on the thread and clicks Comet's summarize button. The AI spots the hidden payload and immediately starts executing an unauthorized multi-step routine. It navigates to Perplexity's account settings to fetch the user's email address, and then hits the login endpoint to request a one-time password.

To slip past existing session authentication, the injected prompt even instructs Comet to hit an alternative domain with a trailing dot. From there, the AI navigates to the user's open Gmail tab, reads the freshly delivered verification code, and replies back to the original Reddit thread with the credentials.

The victim clicked a single button on Reddit, and their Perplexity account was compromised in seconds.

Patches that do not stick

Web security has relied on the Same-Origin Policy for decades to prevent sites from raiding each other's data. But when an AI agent runs inside your authenticated session, that entire security model evaporates. The agent has your full permissions and can jump between active tabs at will.

Brave initially disclosed the flaw to Perplexity on July 25, 2025. Perplexity acknowledged it and rolled out a quick fix two days later, but Brave found the fix incomplete. After more back-and-forth, the issue appeared patched on August 13, leading to the public disclosure on August 20.

Except it was not actually fixed. In a post-publication update, Brave revealed that further testing showed Comet was still vulnerable to the same style of attack, forcing them to re-report it.

Security researcher Simon Willison noted that Comet had holes "you can drive a truck through." But he also warned that Brave might be throwing stones from a glass house, given that Brave is building its own agentic capabilities for its Leo assistant. Brave's suggested mitigations, like cleanly separating instructions from page data, sound great on paper. But as Willison pointed out, the AI community has spent three years failing to solve prompt injection because LLMs inevitably concatenate instructions and data into one single token stream.

Why it matters

We think this incident cuts through the aggressive hype around agentic browsers and reveals a deeply flawed foundation.

For regular users, the lesson right now is simple: do not trust autonomous browser agents with sessions where you are actively logged into personal or corporate accounts. Letting an AI roam through your tabs while your email, online banking, and workplace tools are wide open is an unacceptable risk. Saving thirty seconds on a summary is not worth handing a confused agent the authority to act on your behalf.

For the industry, the vulnerability highlights a dangerous mismatch between AI marketing and computer security fundamentals. Browser sandboxing took decades of rigorous engineering to get right. By contrast, agentic browsers are handing god-mode privileges to statistical models that cannot even tell the difference between code and text.

While Brave deserves credit for exposing the flaw, its own roadmap for Leo faces the exact same structural trap. Relying on the model to evaluate whether its own actions are safe is wishful thinking. Until agentic browsers isolate browsing tasks behind rigid, permissioned sandboxes with mandatory physical confirmations, these assistants remain an open door for anyone clever enough to hide a prompt in plain sight.