AI Browsers Vulnerable to Prompt Injection

🔑 Enhanced Key Takeaways

• •Zenity Labs reported vulnerabilities to Perplexity in 2025, with a patch for Comet issued in February 2026.[1]
• •PromptFix technique uses fake CAPTCHA on webpages to trick AI browsers like Comet into auto-filling credit cards, bypassing checks, and downloading malware.[2]
• •Brave researchers demonstrated unseeable prompt injections via screenshots in Comet, where imperceptible text extracted by OCR overrides user intent to access accounts.[4][5]

🛠️ Technical Deep Dive

• •Attackers embed malicious prompts in webpage HTML using tiny fonts, invisible CSS elements, or URL parameters that the AI parses as user instructions without human visibility.[3]
• •Screenshot attacks in Comet involve OCR extracting hidden text from images pasted into the browser, which is fed to the LLM indistinguishable from the user's query.[4]
• •Prompt injection exploits occur because agentic browsers fail to separate ingested external content (e.g., emails, webpages) from trusted user prompts, enabling autonomous actions like data exfiltration.[1]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline