Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers

SquareX has released critical research exposing a hidden MCP API in Comet that allows extensions in the AI Browser to execute local commands and gain full control over users’ devices, a capability that traditional browsers explicitly prohibit. The research identifies a MCP API (chrome.perplexity.mcp[.]addStdioServer) embedded in Comet’s Agentic extension, which can be triggered by the perplexity[.]ai page to create a covert channel for local data access and arbitrary command execution without user permission.

Documentation on the API is scant, and existing material only covers intent rather than the persistent access and unauthorised application launches now possible through this API. In a reported attack demo, the malicious Analytics Extension injects a script into perplexity[.]ai, which then invokes the Agentic Extension and finally uses the MCP to execute WannaCry on the victim’s device.

The researchers warn that Perplexity’s security posture could be compromised by a single XSS, phishing against a Perplexity employee, or an insider threat, creating catastrophic third‑party risk for Comet users. According to SquareX, the industry must demand API disclosures, third‑party security audits, and user controls to disable embedded extensions to prevent such governance gaps from reoccurring. 19 November 2025.