{"schema_version":"0.10.0","id":"LR-2026-0444","record_version":1,"title":"Perplexity Comet browser flaws allow local file access and 1Password takeover","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.72,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"e2c7d22f9ce102c797a0a1a09c59890c733c4810fc0e2f00fa9cf590d72d5b00"},"system":{"model_name":null,"model_version":null,"developer":"Perplexity AI Inc.","harness":null,"tools_granted":[],"permissions_scope":"inherits whatever access it has been granted","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-03","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"third_party","summary":"Perplexity’s Comet browser, an agentic browser that interprets instructions and autonomously executes tasks, was the subject of research by Zenity Labs. The researchers found that attacker-controlled content, such as a calendar invitation, could steer the agent via indirect prompt injection to access local files, operate inside an authenticated 1Password session, reveal stored credentials and exfiltrate them through ordinary web requests. Zenity disclosed the findings to Perplexity and 1Password before publication. Both companies then introduced mitigations, including stricter user confirmation for sensitive actions and new hardening options such as requiring explicit confirmation before autofilling credentials. Zenity argues that security issues with AI browsers and agentic systems remain ongoing.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"untrusted content can influence an AI agent to take sensitive actions without the user’s awareness","failure_class_detail":"Zero-click: attacker-controlled content such as a malicious calendar invitation could make Comet access the local file system and exfiltrate data","responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":"attacker-controlled content such as a malicious calendar invitation","time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","secondary_risks":["RK03","RK04"],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["B1","B3"],"quote":"Perplexity addressed the underlying browser-side execution issue and introduced additional mitigations, including stricter user confirmation for sensitive actions and enterprise controls that allow administrators to disable the agent on designated sites.","source_index":0,"reviewed":false},{"by":null,"kind":"fix","date_reported":null,"controls_added":["B1"],"quote":"1Password acknowledged the ecosystem-level risk and introduced new hardening options, including disabling automatic sign-in and requiring explicit confirmation before autofilling credentials.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Unbounded scope stated: 1Password is a control plane for many users’ digital identities and takeover could enable rapid downstream compromise of other services","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":"unknown","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://siliconangle.com/2026/03/03/zenity-warns-inherent-security-risks-agentic-browsers-perplexity-comet-findings/","publisher":"SiliconANGLE","date":"2026-03-03","type":"press","title":"Zenity warns of inherent security risks in agentic browsers after Perplexity Comet findings - SiliconANGLE","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"C","system.permissions_scope":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","event.failure_class_detail":"C","event.trigger":"C","event.detection_method":"C","event.root_cause":"C","event.root_cause_detail":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.input_provenance":"C","impact.reversibility":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"A new report out today from Zenity Labs, the research arm of agentic security company Zenity Ltd., details a family of vulnerabilities affecting agentic browsers, including Perplexity AI Inc.’s Comet browser, that can enable zero-click agent hijacking, local file exfiltration and even password vault takeover within authenticated sessions."}],"system.permissions_scope":[{"source_index":0,"quote":"Attackers can push untrusted data into AI browsers and hijack the agent itself, inheriting whatever access it has been granted."}],"event.incident_class":[{"source_index":0,"quote":"A new report out today from Zenity Labs, the research arm of agentic security company Zenity Ltd., details a family of vulnerabilities affecting agentic browsers, including Perplexity AI Inc.’s Comet browser, that can enable zero-click agent hijacking, local file exfiltration and even password vault takeover within authenticated sessions."}],"event.agent_involved":[{"source_index":0,"quote":"A new report out today from Zenity Labs, the research arm of agentic security company Zenity Ltd., details a family of vulnerabilities affecting agentic browsers, including Perplexity AI Inc.’s Comet browser, that can enable zero-click agent hijacking, local file exfiltration and even password vault takeover within authenticated sessions."}],"event.failure_class":[{"source_index":0,"quote":"In various tests, the Zenity Labs researchers were able to demonstrate how Comet could be steered, via indirect prompt injection embedded in untrusted content, to operate inside an authenticated 1Password web session."}],"event.failure_class_detail":[{"source_index":0,"quote":"The first exploit path allows for zero-click compromise, where attacker-controlled content, such as a malicious calendar invitation, can trigger Comet to access the local file system and exfiltrate data while continuing to return expected results to the user."}],"event.trigger":[{"source_index":0,"quote":"In various tests, the Zenity Labs researchers were able to demonstrate how Comet could be steered, via indirect prompt injection embedded in untrusted content, to operate inside an authenticated 1Password web session."}],"event.detection_method":[{"source_index":0,"quote":"A new report out today from Zenity Labs, the research arm of agentic security company Zenity Ltd., details a family of vulnerabilities affecting agentic browsers, including Perplexity AI Inc.’s Comet browser, that can enable zero-click agent hijacking, local file exfiltration and even password vault takeover within authenticated sessions."}],"event.root_cause":[{"source_index":0,"quote":"According to Zenity’s researchers, the execution model introduces what they call an “agent trust failure” where untrusted content can influence an AI agent to take sensitive actions without the user’s awareness."}],"event.root_cause_detail":[{"source_index":0,"quote":"According to Zenity’s researchers, the execution model introduces what they call an “agent trust failure” where untrusted content can influence an AI agent to take sensitive actions without the user’s awareness."}],"event.responsible_party":[{"source_index":0,"quote":"Perplexity addressed the underlying browser-side execution issue and introduced additional mitigations, including stricter user confirmation for sensitive actions and enterprise controls that allow administrators to disable the agent on designated sites."}],"event.adversarial_actor":[{"source_index":0,"quote":"The first exploit path allows for zero-click compromise, where attacker-controlled content, such as a malicious calendar invitation, can trigger Comet to access the local file system and exfiltrate data while continuing to return expected results to the user."}],"event.input_provenance":[{"source_index":0,"quote":"The first exploit path allows for zero-click compromise, where attacker-controlled content, such as a malicious calendar invitation, can trigger Comet to access the local file system and exfiltrate data while continuing to return expected results to the user."}],"impact.reversibility":[{"source_index":0,"quote":"Though the specific vulnerabilities may be patched, Zenity argues that security issues with AI browsers and agentic systems remain ongoing."}],"impact.severity":[{"source_index":0,"quote":"The risk is serious because 1Password functions as a control plane for many users’ digital identities, such an account takeover could enable rapid downstream compromise of other services."}],"impact.severity_because":[{"source_index":0,"quote":"The risk is serious because 1Password functions as a control plane for many users’ digital identities, such an account takeover could enable rapid downstream compromise of other services."}],"event.remediations":[{"source_index":0,"quote":"Perplexity addressed the underlying browser-side execution issue and introduced additional mitigations, including stricter user confirmation for sensitive actions and enterprise controls that allow administrators to disable the agent on designated sites."},{"source_index":0,"quote":"1Password acknowledged the ecosystem-level risk and introduced new hardening options, including disabling automatic sign-in and requiring explicit confirmation before autofilling credentials."}],"event.summary":[{"source_index":0,"quote":"The vulnerabilities, dubbed “PleaseFix,” target a new class of AI-powered browsers that go beyond rendering webpages and instead interpret instructions and autonomously execute tasks across applications."},{"source_index":0,"quote":"The first exploit path allows for zero-click compromise, where attacker-controlled content, such as a malicious calendar invitation, can trigger Comet to access the local file system and exfiltrate data while continuing to return expected results to the user."},{"source_index":0,"quote":"In various tests, the Zenity Labs researchers were able to demonstrate how Comet could be steered, via indirect prompt injection embedded in untrusted content, to operate inside an authenticated 1Password web session."},{"source_index":0,"quote":"Zenity did responsibly disclose the vulnerabilities and the findings to both Perplexity and 1Password before publication."},{"source_index":0,"quote":"Perplexity addressed the underlying browser-side execution issue and introduced additional mitigations, including stricter user confirmation for sensitive actions and enterprise controls that allow administrators to disable the agent on designated sites."},{"source_index":0,"quote":"Though the specific vulnerabilities may be patched, Zenity argues that security issues with AI browsers and agentic systems remain ongoing."}]},"notes_on_gaps":"Only one press source (SiliconANGLE) reporting Zenity Labs research; no primary Zenity, Perplexity or 1Password report was provided. The tests were research demonstrations; the sources do not state whether the flaws were exploited in the wild. No date of occurrence, date of detection, model name, model version, autonomy level, deployment context, safeguard state, duration, containment time, financial loss, record counts or affected-party counts are stated. The fields system.harness, event.trigger and event.failure_class are judgements from the described attack paths. Responsible party as provider and severity major (unbounded scope) are my judgements from the article. The control B2 outcome as missing is inferred from Perplexity adding confirmation for sensitive actions, not from a stated absence. The 1Password hardening is listed as a remediation but 1Password is not the AI system. Reversibility is unknown because the article says the vulnerabilities may be patched without confirming it. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Untrusted content could steer the agent via indirect prompt injection into an authenticated 1Password web session.","quote":"In various tests, the Zenity Labs researchers were able to demonstrate how Comet could be steered, via indirect prompt injection embedded in untrusted content, to operate inside an authenticated 1Password web session.","source_index":0,"grade":"C"},{"step":"reached","text":"Inside the session the agent could browse vault entries, reveal stored usernames and passwords, and send them out through ordinary web requests.","quote":"Once inside, the agent could navigate vault entries, reveal stored usernames and passwords and exfiltrate them through ordinary web requests.","source_index":0,"grade":"C"},{"step":"done","text":"Perplexity fixed the underlying browser-side issue and added stricter confirmation for sensitive actions and administrator controls to disable the agent on designated sites.","quote":"Perplexity addressed the underlying browser-side execution issue and introduced additional mitigations, including stricter user confirmation for sensitive actions and enterprise controls that allow administrators to disable the agent on designated sites.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://siliconangle.com/2026/03/03/zenity-warns-inherent-security-risks-agentic-browsers-perplexity-comet-findings/"]},"analysis":{"sections":{"timeline":[{"text":"Zenity responsibly disclosed the vulnerabilities and findings to Perplexity and 1Password before publication.","quote":"Zenity did responsibly disclose the vulnerabilities and the findings to both Perplexity and 1Password before publication.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://siliconangle.com/2026/03/03/zenity-warns-inherent-security-risks-agentic-browsers-perplexity-comet-findings/"]}}