Perplexity Comet: How One Reddit Comment Turned an AI Browser Into an Account-Takeover Agent

What happened

On August 20, 2025, Brave researchers Artem Chaikin and Shivan Kaul Sahib published a proof of concept against Comet, Perplexity's AI-powered browser. When a user clicked "Summarize this webpage," Comet passed page content to its model without separating the user's request from untrusted text on the page.

The researchers hid instructions behind a spoiler tag in a Reddit comment. When the victim asked for a summary, Comet followed them instead. It navigated to the user's Perplexity account page and extracted the email address. It requested a login one-time password, opened the user's already-authenticated Gmail tab, read the code and replied to the Reddit comment with both. The attacker now had what they needed to take over the account.

Perplexity shipped fixes after disclosure, and Brave reported that later retesting showed the problem was not fully resolved. The underlying issue isn't specific to one vendor. An agentic browser acts with every session its user is logged into, so any page it reads can try to command it.

Why nothing caught it

The same-origin policy, the core protection that keeps one website from reading another, didn't help. The agent itself crossed origins on the user's behalf. Every request came from the real user's browser, with real cookies, from a residential IP. To Gmail and Perplexity, it looked like their customer clicking around.

• Bot management saw a real browser, not a headless scraper
• MFA was satisfied: the agent read the code itself
• EDR saw a signed browser process doing browser things
• No malware, no exploit, no phishing click

How AgentHunter would have stopped it

AgentHunter sits at the edge of your web properties and identity surfaces. It's built to tell human sessions apart from AI-agent sessions, including agents running inside a legitimate, logged-in browser. It does this from behavioral signals: navigation timing, DOM interaction patterns, sequences of cross-page actions and request cadence that no human produces.

In the Comet chain, the decisive moment is step four. An agent session pulls an account email and then immediately requests a one-time password, with no human dwell time. AgentHunter classifies that session as agentic, raises its risk and enforces policy: it challenges, rate-limits or blocks the OTP and account-detail flow. The attacker never gets the code.

For organizations whose employees use agentic browsers, AgentGuard adds the inside view. It inventories which AI browsers and agents are running and which corporate sessions they can reach, and it blocks credential data leaving through an agent's actions.

What to do Monday

Agentic browsers are arriving faster than policy. Before they reach your workforce:

• Inventory AI browsers and assistant extensions in use
• Keep agentic browsing out of privileged admin sessions
• Detect AI-agent traffic on your login, OTP and account pages
• Require step-up verification humans can pass and agents can't

The lesson

Each of these attacks used an AI system that was doing exactly what it was allowed to do, on behalf of someone it should never have obeyed. Patches close one path at a time. AgentHunter closes the class: it judges every agent action against the agent's task, its Principal and its environment, with zero integration and deployment measured in days.

Frequently asked questions