Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet

It's bulletproof.

Do those countermeasures mean human-in-the-loop approving actions manually like users can do with Claude Code, for example?

It still suffers from the LLM forgetting that the string is the important part (and taking the page content as instructions anyway) but maybe they can drill the LLM hard in the training data to reinforce it.

It's clear to a moderator who sees the comment, but the user asking for a summary could easily have not seen it.

This is really an amateur-level attack even after all this VC money and 'top engineers' not even thinking about basic LLM security for an "AI" company makes me question whether if their abilities are inflated / exaggerated or both.

Maybe Perplexity 'vibe coded' the features in their browser with no standard procedure for security compliance or testing.

Shameful.

The browser is the ultimate “lethal trifecta”: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

Giving an LLM’s agentic loop access to the page is just as dangerous as executing user controlled JavaScript (e.g. a script tag in a reddit post).

It’s actually worse than that though. An LLM is like letting attacker controlled content on the page inject JavaScript back into the page.