🤖 Prompt injections in agentic browsers

In August 2025 we found, responsibly disclosed and wrote about an indirect prompt injection attack in Perplexity’s Comet browser. The attack exploited agent-controlled browsing in Comet. We followed this up with several new disclosures which proved that this wasn’t a one-off case of bad security practices and that the entire industry is at severe security risk when it comes to prompt injections.

I’m confident our work has shaped the conversation about the risks of agentic AI browsers and influenced browser vendors in their rollout of safer agentic browsing. OpenAI implemented several of our security recommendations in their release of ChatGPT Atlas.

You can read more on the Brave blog.

Our security work generated a lot of discussion and press:

• TechCrunch - “The glaring security risks with AI browser agents”
• NBC News - “AI browsers are here, and they’re already being hacked”
• TechCrunch - “Anthropic launches a Claude AI agent that lives in Chrome”
• Ars Technica - “Anthropic’s auto-clicking AI Chrome extension raises browser-hijacking concerns”
• The Register - “Perplexity’s Comet browser naively processed pages with evil instructions”
• Search Engine Journal - “Brave Reveals Systemic Security Issues In AI Browsers”
• CNET
• Malwarebytes Labs - “AI browsers could leave users penniless: A prompt injection warning”
• Simon Willison’s blog post about our follow-up attacks
• Simon Willison’s blog post about our initial attack