AI Autopsy · video notes

AI browser hijack: 3 habits that limit the damage

From the Hourwiz video “Your AI read what you couldn't” · Checked 8 October 2026

The fix isn't a smarter AI. It's less power. Here are the three habits from the video, the case behind them, and every source we checked.

The 3 habits

1. Run it logged out. Sign in only when needed. Or use a separate browser profile with no saved logins, so the agent can't reach your email, bank or work accounts by accident.
2. Keep confirmations on. Read them before it sends. Anything that sends, buys, deletes or shares should wait for your click.
3. Narrow tasks. No banking, legal or medical sites. Give a specific task (“summarise this page”), not a broad one (“handle my inbox”).

Our take. “Less power” is our summary of what the sources below recommend: keep the agent away from logged-in sessions, require approval for sensitive actions, and limit access to the minimum it needs.

What happened

On 20 August 2025, Brave's security team published research showing that Perplexity's Comet AI browser followed instructions hidden in a web page. It was a researchers' proof of concept; we found no documented real-world victims.

1. A Reddit comment hid an instruction behind a spoiler tag. Hidden text can also be white on white, or in page code you never see.
2. The user only clicked Comet's button to summarise the page.
3. The AI opened the user's Perplexity account page and copied their email address.
4. It opened Gmail, where the user was already logged in, and read a one-time login code.
5. It posted the email address and the code as a reply to the Reddit comment.

Not passwords: the case was an email address and a one-time login code.

Timeline (per Brave)

• 25 July 2025: reported to Perplexity.
• 27 July: Perplexity acknowledged it and shipped a first fix.
• 28 July: Brave's retest found the first fix was incomplete.
• 13 August: a patch appeared to be in place. 20 August: public disclosure.
• 20 August, after the post went up: Brave added an update saying Perplexity “still hasn't fully mitigated the kind of attack described here. We've re-reported this to them.” (The Register logged the update at 21:45 GMT the same day.)

Perplexity's response: a spokesperson told Decrypt the issue “was patched before anyone noticed” and “We worked directly with Brave to identify and repair it.” Decrypt also reported that, according to Perplexity, no user data was compromised; that part is Decrypt's paraphrase, not a direct quote (checked 10 Oct 2026).

Worth knowing. Brave sells a competing browser with its own AI assistant (Leo), and found the flaw while comparing it with other browsers.

Why it may never be fully fixed

• The UK's National Cyber Security Centre: prompt injection attacks “may never be totally mitigated in the way that SQL injection attacks can be”, because today's models “do not enforce a security boundary between instructions and data inside a prompt”.
• OWASP ranks prompt injection first (LLM01) in its 2025 Top 10 for LLM applications, and says “there is no fool-proof prevention within the LLM”.
• OpenAI's security chief called it “a frontier, unsolved security problem” (Oct 2025); OpenAI later wrote it is “unlikely to ever be fully ‘solved’” (Dec 2025).

Sources

Every fact on this page comes from these pages, opened on 8 October 2026. Things change: check the live page before you rely on it.

1. Brave, “Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet” (20 Aug 2025) The attack steps, timeline and same-day update.
2. Brave, “Unseeable prompt injections in screenshots” (Oct 2025) Isolate agentic browsing.
3. The Register, “Perplexity's Comet browser naively processed pages with evil instructions” (20 Aug 2025, updated) Brave's re-report; Brave's Leo.
4. Decrypt, “Perplexity Comet Flaw Exposed User Data to Attackers, Brave Reports” (25 Aug 2025) Perplexity's statement; quotes re-checked 10 Oct 2026.
5. UK NCSC, “Prompt injection is not SQL injection (it may be worse)” (8 Dec 2025)
6. OWASP GenAI Security Project, LLM01:2025 Prompt Injection Least privilege; human approval.
7. Anthropic, “Piloting Claude for Chrome” Confirmations; avoiding sensitive sites.
8. Simon Willison, “OpenAI CISO on Atlas” (22 Oct 2025) The “unsolved” quote.
9. Fortune, on OpenAI's prompt-injection hardening (23 Dec 2025) OpenAI post: openai.com
10. MediaNama, prompt injections in AI browsers (Dec 2025)
11. Cloud Security Alliance research note (22 Sep 2026) Dedicated profiles without logged-in sessions.

General security practice, not professional security advice.

No sponsor and no affiliate links on this page. Vendors are named so you can check them yourself, not as recommendations.

Follow Hourwiz

• YouTube@hourwiz (opens in a new tab)
• Instagram@hourwiz.ai (opens in a new tab)
• Facebookhourwizhq (opens in a new tab)

Get the week’s videos in one email

All video pages · Back to Hourwiz home