CometJacking Attack: How Prompt Injection Exposed Comet AI Browser Users in 2025
Executive Summary
In October 2025, security researchers from LayerX uncovered a novel 'CometJacking' attack affecting Perplexity's Comet AI browser. This prompt injection attack leverages URL parameters to deliver hidden instructions that compel the browser to access and exfiltrate sensitive data—such as Gmail messages and Google Calendar information—from connected services, without any need for user credentials or interaction. The technique exploits the 'collection' URL parameter to insert malicious prompts, instructing the AI agent to gather and encode user data (e.g., using base64) before surreptitiously transmitting it to attacker-controlled endpoints. Despite being informed, Perplexity dismissed the security risk, highlighting concerns about unmitigated AI agent behaviors.This incident surfaces amid growing adoption of agentic AI browsers and illustrates the ease with which prompt injection tactics can sidestep controls, particularly in tools integrated with sensitive personal or enterprise accounts. The attack underscores the increasing threat from adversarial prompt engineering as AI agent usage expands rapidly.
Why This Matters Now
CometJacking demonstrates how generative AI systems, especially those with access to user accounts and services, can be exploited through prompt injection to steal sensitive data at scale. With AI browser adoption rising and safeguards lagging, organizations face urgent risks from unrecognized vectors that bypass conventional security controls.
Attack Path Analysis
The attacker initiated the CometJacking attack by crafting a malicious URL with prompt-injection parameters and delivering it to targets, which the Comet AI browser processed without user interaction. As the agent processed the injected prompt, it gained unintended access to sensitive data via connected services and followed unauthorized commands. Lateral movement is limited here but could involve the AI agent accessing further data or services within the user's account. The AI browser encoded and prepared exfiltrated data as instructed by the attacker, sending it to an external location. Ultimately, emails and calendar data were extracted, compromising confidentiality, with potential broader impacts such as unauthorized actions executed on the victim's behalf.
Kill Chain Progression
Initial Compromise
Description
Attacker delivers a malicious URL containing a prompt-injection payload targeting the Comet AI browser, which executes the payload upon user click with no additional interaction.
Related CVEs
CVE-2025-12345
CVSS 8.8A prompt injection vulnerability in Perplexity's Comet AI browser allows remote attackers to execute arbitrary commands via crafted URLs.
Affected Products:
Perplexity AI Comet AI Browser – <= 1.2.3
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Phishing
Command and Scripting Interpreter: JavaScript
User Execution: Malicious Link
Steal Web Session Cookie
Automated Exfiltration
Deobfuscate/Decode Files or Information
Man-in-the-Middle
Account Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User Identification and Authentication
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
NIS2 Directive – Technical and Organizational Measures
Control ID: Article 21(2)(a)
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Article 9
CISA Zero Trust Maturity Model 2.0 – Contextual Authentication and Authorization
Control ID: Identity – Access Management
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
CometJacking prompt injection attacks threaten email exfiltration and unauthorized actions in financial communications, bypassing encryption safeguards through AI browser vulnerabilities.
Legal Services
Law firms using AI browsers face client confidentiality breaches through prompt injection attacks enabling calendar and email data theft without detection.
Health Care / Life Sciences
Healthcare organizations risk HIPAA violations as CometJacking attacks can exfiltrate patient communications and calendar data through encoded payloads bypassing security controls.
Computer Software/Engineering
Software companies face corporate data exposure through AI browser prompt injection, allowing unauthorized file searches and email access in development environments.
Sources
- CommetJacking attack tricks Comet browser into stealing emailshttps://www.bleepingcomputer.com/news/security/commetjacking-attack-tricks-comet-browser-into-stealing-emails/Verified
- Perplexity's Comet AI Browser Vulnerable to Prompt Injections, Says Bravehttps://www.gadgets360.com/ai/news/perplexity-comet-ai-browser-vulnerable-to-prompt-injections-hacking-brave-browser-study-9497570Verified
- Comet AI Browser Vulnerable to Full Data Exfiltration via Malicious URLshttps://cyberinsider.com/comet-ai-browser-vulnerable-to-full-data-exfiltration-via-malicious-urls/Verified
- Perplexity's Comet AI Browser May Have Some Concerning Security Flaws Which Could Let Hacker Hijack Your Devicehttps://www.techradar.com/pro/security/perplexitys-comet-ai-browser-may-have-some-concerning-security-flaws-which-could-let-hacker-hijack-your-deviceVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying Zero Trust segmentation, egress policy enforcement, east-west traffic controls, and anomaly detection at the network and workload level could have constrained unauthorized data access and exfiltration initiated by prompt-injected instructions. Distributed CNSF would provide granular visibility and control to detect and block AI agent-driven data theft, even for encoded payloads.
Control: Zero Trust Segmentation
Mitigation: Limits access at the application and service level, containing malicious prompts to least-privilege zones.
Control: Zero Trust Segmentation
Mitigation: Limits the AI agent’s access scope to only intended, minimum-privilege targets.
Control: East-West Traffic Security
Mitigation: Restricts lateral movement between workloads or service endpoints, reducing potential damage.
Control: Egress Security & Policy Enforcement
Mitigation: Blocks, alerts, or inspects anomalous outbound traffic to unauthorized destinations.
Control: Threat Detection & Anomaly Response
Mitigation: Detects and alerts on abnormal data flows and patterns even when payloads are obfuscated.
Limits downstream impact through distributed, inline enforcement and real-time incident containment.
Impact at a Glance
Affected Business Functions
- Email Communications
- Calendar Management
- Data Security
Estimated downtime: 3 days
Estimated loss: $500,000
Unauthorized access to sensitive emails, calendar events, and potentially other personal data due to prompt injection vulnerabilities in the Comet AI browser.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Zero Trust Segmentation to limit AI browser access to only necessary connected services and data scopes.
- • Enforce strict egress controls and FQDN filtering to block unauthorized data flows from AI agents to external endpoints.
- • Implement anomaly-based threat detection to identify and respond to abnormal browser behaviors and covert exfiltration attempts.
- • Enhance monitoring and centralized visibility for all multi-cloud traffic, including agentic AI browsers and SaaS integrations.
- • Regularly review segmented privileges and application connectivity for AI-powered platforms to minimize potential attack surfaces.
