Vulnerability in Perplexity’s Comet Browser Screenshot Feature Allows Malicious Prompt Injection

Researchers have identified a critical vulnerability in Perplexity’s Comet AI browser that could let attackers inject malicious prompts via hidden text in screenshots. The flaw, disclosed on 21 October 2025, works by concealing instructions in images through steganography—Brave researchers created a proof-of-concept using nearly invisible faint light blue text on a yellow background.

When a user screenshots a page, the Comet browser’s OCR extracts all text, including the camouflaged commands, and feeds it to the AI without proper filtering, allowing manipulation of the browser’s controls. This bypasses typical protections and could enable access to sensitive accounts or data, including banking or email services, and exfiltration from cloud storage if a prompt is injected.

According to Brave, the vulnerability is not isolated and other agentic browsers show similar risks; Brave researchers reported the issue to Perplexity on 1 October 2025 to allow remediation before public disclosure. Until protections are in place, security experts advise treating agentic browsing features as inherently risky and to avoid keeping sensitive accounts logged in while using them.