Hidden webpage text makes Perplexity’s Comet browser leak a login code

Timeline

• 2025-07-25. Brave finds and reports the issue.
• 2025-07-27. Perplexity acknowledges it and ships a first fix.
• 2025-07-28. Brave’s retest finds the fix incomplete.
• 2025-08-13. Brave’s testing indicates the issue is patched.
• 2025-08-20. Brave publishes, then updates its post to say the attack is still not fully mitigated.

Trigger or entry point

A webpage with hidden instructions, which the user asks Comet to summarize.

Failure mechanism

According to Brave, Comet passed the page’s text to its model without separating it from the user’s request. The model treated the hidden text as instructions. Because the browser acts with the user’s logged-in sessions, the agent could open other sites as the user.

Impact

In the demonstration the agent obtained a one-time password from the user’s Gmail and posted it where the attacker could read it. That is enough to take over the user’s Perplexity account. The severity is potential.

Response

Perplexity shipped fixes. The Register reports that Perplexity did not immediately respond to its request for comment, and that Brave could not inspect the patch because Comet is not open source.

Mitigations

Brave recommends keeping agentic browsing separate from regular browsing, and starting agent actions such as opening sites or reading email only when the user explicitly asks for them.