{"schema_version":"0.10.0","id":"LR-2026-0457","record_version":1,"title":"Researchers trick Perplexity Comet browser into phishing scam","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"a17cff8f26cf6a9ade6b3470bb57385c724980f64edb972b701e02fe4fb42a84"},"system":{"model_name":null,"model_version":null,"developer":"Perplexity","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Autonomously executing actions across multiple websites on behalf of a user","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-11","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Researchers at Guardio reported that Perplexity's Comet AI browser, an agentic browser that acts across websites for a user, could be trained to fall for a phishing scam. They intercepted traffic between the browser and the vendor's AI services and fed it into a Generative Adversarial Network to build a scamming machine that iteratively regenerates a phishing page. The researchers said the browser fell victim to the scam in under four minutes. They argued that such a page, once tuned against one AI browser, works on all users who rely on the same agent. No date of occurrence, loss or affected users is stated.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: contained to one evaluation with no third party touched, as the sources describe a research demonstration. Fact: the sources state no loss or affected party beyond the demonstration.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/03/researchers-trick-perplexitys-comet-ai.html","publisher":"The Hacker News","date":"2026-03-11","type":"press","title":"Researchers Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.intended_use":"C","event.incident_class":"C","event.agent_involved":"C","event.detection_method":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes."}],"system.intended_use":[{"source_index":0,"quote":"Agentic web browsers that leverage artificial intelligence (AI) capabilities to autonomously execute actions across multiple websites on behalf of a user could be trained and tricked into falling prey to phishing and scam traps."}],"event.incident_class":[{"source_index":0,"quote":"By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes."}],"event.agent_involved":[{"source_index":0,"quote":"Agentic web browsers that leverage artificial intelligence (AI) capabilities to autonomously execute actions across multiple websites on behalf of a user could be trained and tricked into falling prey to phishing and scam traps."}],"event.detection_method":[{"source_index":0,"quote":"The attack, at its core, takes advantage of AI browsers' tendency to reason their actions and use it against the model itself to lower their security guardrails, Guardio said in a report shared with The Hacker News ahead of publication."}],"impact.severity":[{"source_index":0,"quote":"By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes."}],"impact.severity_because":[{"source_index":0,"quote":"By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes."}],"event.summary":[{"source_index":0,"quote":"Agentic web browsers that leverage artificial intelligence (AI) capabilities to autonomously execute actions across multiple websites on behalf of a user could be trained and tricked into falling prey to phishing and scam traps."},{"source_index":0,"quote":"By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes."},{"source_index":0,"quote":"The idea, in a nutshell, is to build a \"scamming machine\" that iteratively optimizes and regenerates a phishing page until the agentic browser stops complaining and proceeds to carry out the threat actor's bidding, such as entering a victim's credentials on a bogus web page designed for carrying out a refund scam."},{"source_index":0,"quote":"What makes this attack interesting and dangerous is that once the fraudster iterates on a web page until it works against a specific AI browser, it works on all users who rely on the same agent."}]},"notes_on_gaps":"Only one source is given. It is a press article reporting a Guardio research report; no date of occurrence, model name or version, deployment context, lifecycle stage, autonomy level, permissions, or loss figures are stated. The duration 'under four minutes' is an upper bound, not an exact figure, so no duration field was filled. date_disclosed uses the article date from source metadata (2026-03-11). The failure_class was left out because no closed-list category is clearly stated for this demonstration. trigger, root_cause, responsible_party and adversarial_actor were left out because the sources do not state them; the attack was a researcher demonstration, not a reported live incident. Severity 'minor' is my judgement: the test is contained to one evaluation and no third party is stated as touched, though the researchers say the same attack would reach all users of the agent. The D1 link is my judgement that the lowered guardrails correspond to safety training and refusal. Other controls named in the article (for PerplexedBrowser, Trail of Bits prompt injections) concern different incidents and were not reported. No remediation for this incident is stated, so remediations is empty. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Perplexity's Comet AI browser, an agentic browser, acts across websites for a user.","quote":"Agentic web browsers that leverage artificial intelligence (AI) capabilities to autonomously execute actions across multiple websites on behalf of a user could be trained and tricked into falling prey to phishing and scam traps.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Researchers fed intercepted browser traffic into a GAN and made the browser fall victim to a phishing scam.","quote":"By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes.","source_index":0,"grade":"C"},{"step":"reached","text":"The described aim was for the browser to enter a victim's credentials on a bogus refund page.","quote":"The idea, in a nutshell, is to build a \"scamming machine\" that iteratively optimizes and regenerates a phishing page until the agentic browser stops complaining and proceeds to carry out the threat actor's bidding, such as entering a victim's credentials on a bogus web page designed for carrying out a refund scam.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/03/researchers-trick-perplexitys-comet-ai.html"]},"analysis":{"sections":{"timeline":[{"text":"Guardio reported the browser fell victim to the phishing scam in under four minutes.","quote":"By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/03/researchers-trick-perplexitys-comet-ai.html"]}}