A documented attack, not a hypothetical
AI browser agents — tools that browse, click, and act on the web on a user's behalf — represent one of the clearest real-world demonstrations of indirect prompt injection risk. Brave's security team publicly demonstrated a working attack against Perplexity's Comet AI browser agent: by hiding adversarial instructions inside invisible elements on a web page, they caused the agent to execute sensitive cross-site actions, including fetching one-time passwords and accessing banking portals, all carried out using the legitimate user's own logged-in session.
Why this attack works: the agent reads what you can't see
An AI browser agent doesn't view a page the way you do — it parses the raw underlying content, including HTML elements hidden from visual display through CSS (display:none, zero font size, matching text-and-background color) or invisible Unicode characters. Content completely invisible to a human skimming the page is fully present and actionable to the agent processing that same page's raw markup.
Why session scope determines the blast radius
The Comet demonstration was effective specifically because the agent operated with access to the user's broader logged-in browser sessions — banking included — rather than being scoped narrowly to the specific site or task at hand. An agent limited to a single site or task has a correspondingly limited attack surface, even if manipulated by the exact same hidden-content technique.
The two permissions that matter most
- Autonomous purchase completion. An agent able to complete a purchase without per-transaction confirmation converts a successful manipulation directly into financial loss.
- Unconfirmed credential autofill. An agent that autofills and submits credentials without per-site confirmation can be redirected — via hidden injected instructions — to submit those credentials to an unintended, attacker-controlled destination.
Cross-origin data movement is the pattern to watch for
Enterprise AI browser agent risk assessments specifically flag cross-origin data movement — an agent reading information from one site and acting on a different, unrelated site — as a core exposure point, since this is precisely the mechanism that let the Comet demonstration turn a hidden instruction on one page into an action against an entirely different, sensitive site.
Why visibility into agent actions matters as much as prevention
Even a well-configured agent can be manipulated by a sufficiently novel technique, which is why a reviewable log of every page visited and action taken matters as a second line of defense — it's the difference between noticing a manipulation immediately versus discovering consequences only after real damage occurs.
Living with agentic browsing, safely
None of this means AI browser agents can't be used responsibly — it means treating session scope, purchase/credential confirmation, and action visibility as the actual controls that determine risk, rather than trusting the underlying model to reliably distinguish your instructions from hidden ones embedded in whatever page it happens to visit.
Frequently Asked Questions
Yes — Brave's security team publicly demonstrated a working indirect prompt injection attack against Perplexity's Comet AI browser agent, hiding instructions in invisible page elements that caused it to fetch one-time passwords and access banking portals using the real user's own logged-in session.
An AI browser agent parses the raw underlying HTML of a page, not just what's visually rendered. Content hidden through CSS techniques (display:none, zero font size, matching text-and-background color) or invisible Unicode characters is completely absent from what you see, but fully present and processable in the raw content the agent reads.
The documented Comet demonstration was effective specifically because the agent had access to the user's broader session scope, including banking — allowing a hidden instruction encountered on one page to trigger an action against a completely different, sensitive site. An agent scoped narrowly to a single task has a correspondingly smaller attack surface.
Autonomous purchase completion without per-transaction confirmation, and credential autofill/submission without per-site confirmation. Both convert a successful hidden-instruction manipulation directly into a real-world consequence — financial loss or credential theft — rather than a harmless misunderstanding.
Yes — the AI Browser Agent Risk Checklist is a weighted 12-point checklist built directly around the documented Brave/Comet attack, covering session scope, purchase and credential confirmation, and action-log visibility, with a live 0-100 risk score.