Perplexity's BrowseSafe patches agent gaps after Brave finds Comet flaw
Perplexity’s newest safety layer, BrowseSafe, arrived just as the AI‑browser community began to reckon with a glaring blind spot. The company has long touted its agents as “secure by design,” yet the underlying architecture still relied on a single‑prompt model that can be swayed by external content. While the concept sounds solid, real‑world testing exposed a crack.
Earlier this year, a separate security team flagged an anomaly in the Comet assistant that runs inside many browsers. Their findings showed that malicious actors could embed covert instructions in ordinary web pages or comment sections, then watch the assistant treat those snippets as legitimate user commands. This isn’t a theoretical concern; it translates into a direct pathway for hijacking user sessions, leaking data, or prompting unwanted actions.
The incident forced Perplexity to rethink its approach, prompting a rapid rollout of BrowseSafe patches aimed at filtering out such hidden prompts. The severity of the issue became clear in August 2025, when Brave discovered a security vulnerability in Comet. Using a technique known as indirect prompt injection, attackers hid commands in web pages or comments.
The AI assistant then misinterpreted these hidden commands as user instructions while
The severity of the issue became clear in August 2025, when Brave discovered a security vulnerability in Comet. Using a technique known as indirect prompt injection, attackers hid commands in web pages or comments. The AI assistant then misinterpreted these hidden commands as user instructions while summarizing content.
Brave showed that this method could be used to steal sensitive information, including email addresses and one-time passwords. Perplexity argues that existing benchmarks like AgentDojo are insufficient for these threats. They typically rely on simple prompts like "Ignore previous instructions," whereas real-world websites contain complex, chaotic content where attacks can be easily concealed.
Defining the scope of real-world attacks To address this, Perplexity built the BrowseSafe Bench around three specific dimensions.
BrowseSafe arrives as a direct response to the Comet breach uncovered by Brave in August 2025, where hidden commands on web pages caused an AI assistant to act on unintended instructions. Perplexity claims a 91 percent detection rate for prompt‑injection attacks, outpacing PromptGuard‑2’s 35 percent and edging ahead of GPT‑5’s 85 percent. The system’s reported speed suggests it can operate in real‑time, a practical requirement for any browser‑based agent.
Yet the figures speak only to controlled tests; it is unclear whether the same success will translate to the chaotic, adversarial environments where attackers constantly evolve their tactics. The comparison with other models highlights a gap, but the absence of independent verification leaves the robustness of BrowseSafe open to question. If the detection rate holds under broader scrutiny, the tool could narrow a known vulnerability window. Until external audits confirm these results, the extent to which BrowseSafe will close the security gap remains uncertain.
Further Reading
- Perplexity's BrowseSafe tries to patch the gaping security holes inherent in AI browser agents - The Decoder
- BrowseSafe: Understanding and Preventing Prompt Injection Within Open-World Web Environments - Perplexity AI Research
- Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet - Brave
- Researchers Warn of Security Gaps in AI Browsers - Infosecurity Magazine
- The Browser Security Trilemma of 2025: How Perplexity Comet, Chrome, and Oasis Rewrote the Risk Equation - Kahana
More in Business & Startups
Qwen3‑TTS‑Flash Review: Open TTS Model Excels at Dialects and Natural Speech
Why do most text‑to‑speech services still sound flat when you ask them to sound local?
Chance AI targets India with visual Perplexity platform, student‑led rollout
Chance AI, the startup behind a visual spin on the Perplexity search experience, has set its sights...
Google's bundled search and AI crawlers gather three times OpenAI's data
Google’s search engine still pulls in the bulk of web traffic, and that volume translates into a...
Meta strikes AI licensing deals with CNN, Fox News, USA Today, People
Why does this matter now? Meta’s latest licensing push signals a shift in how the company feeds its...
Replit adds Vibe coding to Google Cloud, using Cloud Run, GKE, BigQuery
Replit is pushing its Vibe coding suite onto Google Cloud, aiming squarely at large‑scale business...
Common Questions Answered
What vulnerability did Brave uncover in the Comet assistant in August 2025?
Brave identified an indirect prompt injection flaw where hidden commands embedded in web pages or comments were misinterpreted by the Comet AI assistant as user instructions. This allowed attackers to extract sensitive data such as email addresses and one‑time passwords during content summarization.
How does Perplexity's BrowseSafe safety layer address the Comet prompt‑injection issue?
BrowseSafe introduces a real‑time detection system that scans incoming prompts for hidden injection patterns, achieving a reported 91 percent detection rate for such attacks. By filtering malicious inputs before they reach the AI model, it aims to prevent the assistant from executing unintended commands.
How does BrowseSafe's detection performance compare to PromptGuard‑2 and GPT‑5?
Perplexity claims BrowseSafe detects 91 percent of prompt‑injection attempts, significantly higher than PromptGuard‑2's 35 percent and edging out GPT‑5's 85 percent detection rate. These figures suggest BrowseSafe offers a stronger defensive posture for browser‑based agents.
Why was Perplexity's previous single‑prompt architecture considered a security risk?
The earlier design relied on a single prompt that could be directly influenced by external content, making it vulnerable to indirect prompt injection attacks like those demonstrated in the Comet breach. Without additional safeguards, malicious actors could embed hidden commands that the AI would execute as if they were legitimate user instructions.