Case comet-reddit-injection-braveAgent hijackUnited States
Brave shows Perplexity Comet can be hijacked by a Reddit comment to steal Gmail OTPs
Brave found hidden text in a Reddit post could make Comet open Gmail, trigger account recovery and send the one-time code to the attacker when the user clicked Summarize. Perplexity patched; Brave said it was incomplete.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 20, 2025
- Location
- United States
- Target
- Perplexity Comet AI browser
- Severity
- High
- Triggered by
- Brave security and privacy team
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Brave found hidden text in a Reddit post could make Comet open Gmail, trigger account recovery and send the one-time code to the attacker when the user clicked Summarize. Perplexity patched; Brave said it was incomplete.
Impact: Proof of concept exfiltrated email addresses and Gmail recovery codes; Perplexity said no user data was compromised
Who triggered it
Actor: Brave security and privacy team
Attribution: Responsible disclosure by a competing browser vendor; Perplexity disputed severity
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in page content fed to the assistant without separating user instructions from untrusted text; agent acted across logged-in tabs
Root cause: Comet passed web page text to the model as part of the instruction stream and could act with the user's authenticated sessions
Timeline
- Brave reports the vulnerability to Perplexity
- Perplexity ships an initial fix
- Brave finds the patch can still be bypassed
- Brave publishes the disclosure
Response
Perplexity patched the reported case and said it was fixed before anyone noticed; Brave maintained Comet remained exploitable
Current status: Patched
Sources (open in a new tab)
- Simon Willison simonwillison.net
- Decrypt decrypt.co
- Yahoo Finance finance.yahoo.com
Cite this case
Brave shows Perplexity Comet can be hijacked by a Reddit comment to steal Gmail OTPs. AI Threat Watch, case comet-reddit-injection-brave, Aug 20, 2025. https://aithreat.io/cases/comet-reddit-injection-brave/
Permanent link: https://aithreat.io/cases/comet-reddit-injection-brave/