I am unsure if many people realize how serious this is. I hope people wake up to realize just how unwieldy this can get (https://nvd.nist.gov/vuln/detail/CVE-2025-6763).

Essentially, from my research, “comet-jacking” is a practical prompt-injection technique that weaponizes agentic AI browsers (i.e., Perplexity’s Comet) to exfiltrate or act on data from already-authorized accounts with one click — turning delegated OAuth/connector access into an immediate privilege-escalation and lateral-movement vector.

Comet’s agent based features can read and act on data from services the user has already granted (Gmail, Calendar, Drive, etc.). A prompt injection hidden in a URL can cause the agent to retrieve or forward that data — without password theft — effectively abusing preconfigured settings of which the agent also simultaneously inherits delegated OAuth scopes and operates with the user’s authority, so a successful prompt injection equates to an attacker obtaining the same operational ability as a compromised session (read/send emails, create calendar events, seed forwarding rules, harvest tokens present in memory — EVERYTHING).

Such an attack also bypasses string matchers by encoding payloads and hiding instructions in innocuous parameters or code blocks — meaning host/edge/fog protections that assume human-readable indicators will likely miss it. block or quarantine unknown agentic browser binaries with EDR/allowlists, and augment logging to capture agent-originated API calls and unusual forwarding or rule-creation events.

At network/edge, filter and decode suspicious URL parameters, flag base64/encoded payloads for inspection, and add agent-aware telemetry to SIEM/UEBA so that “agent acted as user” patterns trigger playbooks. For a technical breakdown and PoC artifacts, see the LayerX report: https://layerxsecurity.com/blog/cometjacking-how-one-click-can-turn-perplexitys-comet-ai-browser-against-you.

Sources:

https://layerxsecurity.com/blog/cometjacking-how-one-click-can-turn-perplexitys-comet-ai-browser-against-you/

https://thehackernews.com/2025/10/cometjacking-one-click-can-turn.html