I Read Every Public Security Disclosure About Perplexity's Comet Browser. There Are Six.

TL;DR: Comet is the most polished agentic browser you can use today, it costs nothing, and its security record is the most instructive document in AI. I compiled every public security disclosure about it: six distinct findings in six and a half months, from hidden-text prompt injection to a zero-click calendar-invite attack that exfiltrated files and 1Password credentials. Use it for research and summarization. Do not let it touch anything logged in that you care about.

Perplexity's Comet is the flagship of the agentic browser category: Chromium underneath, an assistant bolted into the chrome, and the promise that the browser will stop being a window and start being an employee. It launched in July 2025 as an exclusive for the $200-a-month Max tier, then went free for everyone that October, with mobile following. Since I cannot review the marketing, I reviewed the record: the product's documented capabilities, the independent reviews, and every security disclosure I could find, each verified against the original researcher's publication.

What does Comet claim to do?

Summarize any page, answer questions in a sidebar, fill forms, and run multi-step tasks like shopping and booking on your behalf. The browser itself is free; a $5-a-month Comet Plus layer adds a curated news product, and Pro and Max subscribers get it bundled. Max subscribers also get the "background assistant," pitched by Perplexity as a team of assistants running jobs in parallel while you do something else. The scale behind it is real: CEO Aravind Srinivas said Perplexity handled 780 million queries in May 2025, and the company has raised at a roughly $20 billion valuation.

The reviewer consensus on the assistant half is genuinely positive. Tom's Guide ran it through seven everyday tasks and called the results clear, efficient, and genuinely useful for research, planning, and summarization. The same consensus turns cautious on the autonomous half: multi-step agentic flows are inconsistent, especially anything involving checkout or logins. That should sound familiar; it is the agent demo-to-production gap wearing a browser skin.

What broke?

Here is the count nobody publishes in one place. Between August 20, 2025 and March 3, 2026, six distinct security findings about Comet were publicly documented, each by a named research team:

1. Summarize-page prompt injection (Brave, Aug 2025). Hidden instructions in a web page, white text or a spoiler tag, get executed when you ask Comet to summarize. Brave's proof of concept read the victim's account email, triggered a Gmail one-time passcode, and exfiltrated both: account takeover via Reddit post.
2. "Scamlexity" (Guardio Labs, Aug 2025). On a fake storefront, Comet autofilled a saved credit card and completed the purchase without asking. It also walked into a live phishing page and helped enter credentials.
3. "CometJacking" (LayerX, Oct 2025). A single crafted URL makes the assistant read your stored memory, base64-encode your emails and contacts to slip past exfiltration checks, and ship them to an attacker.
4. "Unseeable" injection (Brave again, Oct 2025). Near-invisible text inside an image becomes commands when the page is screenshotted, via OCR.
5. MCP API command execution (SquareX, Nov 2025). An undocumented private API reachable through Comet's embedded extensions could execute arbitrary commands on the host machine; the proof of concept launched actual ransomware. The tool layer this rides on is still mostly unlabelled: 34 of 50 MCP servers set no annotation telling a client which of their calls destroys something. Perplexity disputed the framing publicly and, per SquareX, patched it quietly.
6. "PleaseFix" (Zenity Labs, disclosed Mar 2026). Zero-click: a calendar invite carrying hidden instructions makes the agent exfiltrate local files and 1Password credentials during normal use. Perplexity's first fix was bypassed within weeks; the second patch, in February 2026, held.

Two details in that list matter more than the list. First, the repeat pattern: the same root cause, untrusted page content treated as instructions, keeps producing new variants faster than patches close old ones. Second, the disclosure friction: one finding was initially triaged by Perplexity as "no security impact," another was publicly disputed, and the zero-click fix needed two attempts.

Why does this keep happening?

Because the architecture is the vulnerability. Simon Willison named the pattern the "lethal trifecta": access to your private data, exposure to untrusted content, and the ability to communicate externally. A logged-in agentic browser is all three by definition, which is why Brave's researchers concluded that "traditional Web security assumptions don't hold for agentic AI". The assistant acts with your authenticated privileges; the web page it reads is the attacker's keyboard. No agentic browser vendor has solved this. Comet just has the most users, so it has the best-documented record.

Is it worth using?

Yes, with a boundary you should treat as physical. As a research browser, Comet is free and legitimately good: summarization, question-answering over pages, planning. I would use it for exactly that, in a dedicated profile with nothing logged in, no saved cards, no password manager extension, and its memory feature switched off, so the worst case of a hostile page is a bad summary rather than a breach. What I would not do, on the current record, is let it operate a browser session that holds my email, my bank, my password manager, or my saved cards, because five of the six findings above turn precisely those into the payload.

The buying question from the demo post applies with extra force here: show me it failing, and show me what happens next. For Comet, the failure documentation exists, six times over, written by security researchers instead of the vendor. That transparency, however involuntary, is the most useful spec sheet in the category. Read it before you sign in.