AI Risk Wire

Cases › security breach › LR-2026-0457

Researchers trick Perplexity Comet browser into phishing scam

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Status: no action reported

Severity minor
Reported 11 Mar 2026
Developer and model Perplexity

No source states: loss or records, agent tool, could do, deployer, industry.

Severity minor: Test: contained to one evaluation with no third party touched, as the sources describe a research demonstration. Fact: the sources state no loss or affected party beyond the demonstration.

Researchers at Guardio reported that Perplexity's Comet AI browser, an agentic browser that acts across websites for a user, could be trained to fall for a phishing scam. They intercepted traffic between the browser and the vendor's AI services and fed it into a Generative Adversarial Network to build a scamming machine that iteratively regenerates a phishing page. The researchers said the browser fell victim to the scam in under four minutes. They argued that such a page, once tuned against one AI browser, works on all users who rely on the same agent.

What happened

1 · What it was doingPerplexity's Comet AI browser, an agentic browser, acts across websites for a user.
2 · What went wrongResearchers fed intercepted browser traffic into a GAN and made the browser fall victim to a phishing scam.
3 · What it reached or didThe described aim was for the browser to enter a victim's credentials on a bogus refund page.

What was done

No source states an action or fix.

Risks

AI system attacked or breached
Primary23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Similar incidents

Perplexity Comet browser agent bypasses file:// hard boundary twice, enabling local file exfiltration and 1Password vault takeover2026-10-27
Federal judge blocks Perplexity's AI browser from making Amazon purchases2026-03-10
Perplexity Comet browser flaws allow local file access and 1Password takeover2026-03-03

All cases of this kind ›

Evidence

No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 1 items from the primary sources

What happened, in order

Not dated in the sources:

  • Guardio reported the browser fell victim to the phishing scam in under four minutes.
Show every field, with its source and grade

The AI system

Developer
Perplexity
C one secondary source states it
What it was for
Autonomously executing actions across multiple websites on behalf of a user
C one secondary source states it

What happened

Earliest source we hold
2026-03-11
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
Test: contained to one evaluation with no third party touched, as the sources describe a research demonstration. Fact: the sources state no loss or affected party beyond the demonstration.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Other controls named in the article (for PerplexedBrowser, Trail of Bits prompt injections) concern different incidents and were not reported. No remediation for this incident is stated, so remediations is empty.

LR-2026-0457 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON