- ID
- AIA-011
- Category
- AI AI agent incident
- Disclosed
- 2025-08
- Systems
- Perplexity Comet
- Harm type
- Prompt injection / account takeover
- Status
- reported
Reported to Perplexity July 25, 2025; public disclosure August 20, 2025. Brave notes Perplexity "still hasn't fully mitigated" it on further testing; not confirmed fixed.
Summary
Brave showed that hidden instructions in a Reddit comment could make the Comet agentic browser act across the user's logged-in sessions: go to Gmail, read an OTP, and exfiltrate the email address and OTP by replying to the comment. Brave says Perplexity still hasn't fully mitigated it.
Controls
Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.
NIST AI RMF
- MAP 4.1 Risks from third-party components are mapped
- MEASURE 2.7 Security and resilience are evaluated and documented
NIST SP 800-53
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SI-10 Information Input Validation
- IA-2 Identification and Authentication (Organizational Users)
Human-approval (JCR) checkpoint
Sources
- brave.com primary link checked 2026-10-31, HTTP 200
Reported July 25, 2025; public disclosure August 20, 2025
https://brave.com/blog/comet-prompt-injection/
Corrections
- Verification round 1: date month and summary verified against the Brave post (public disclosure Aug 20, 2025). Added attack detail (Gmail OTP read and exfiltrated via a Reddit reply) and Brave's note that it is not fully mitigated. Status stays reported.
To report an error in this entry, see corrections.