AI Browser Vulnerabilities Expose Users to OAuth Attacks and Malware
Security researcher SquareX disclosed vulnerabilities in AI browsers like Comet that allow attackers to exploit them into stealing data, distributing malware, and gaining unauthorized access to accounts. The vulnerabilities stem from AI browsers being trained to complete tasks without security awareness, making them susceptible to social engineering by attackers.
What happened
Security researcher SquareX released critical research on October 9, 2025 exposing vulnerabilities in AI browsers including Comet that could allow attackers to exploit them to exfiltrate sensitive data, distribute malware and gain unauthorized access to enterprise SaaS applications.
SquareX documented multiple attack scenarios: in one example, Comet fell prey to an OAuth attack that provided attackers with full access to the victim's email and Google Drive; in another, Comet distributed a malicious link to a colleague through a calendar invite while completing inbox tasks; attackers also tricked Comet into downloading known malwares and emailing sensitive files.
Reported impact
The vulnerabilities could result in exfiltration of every file stored on a victim's account, including files shared by colleagues and customers, and unauthorized distribution of malicious content to other users.
SquareX warned that as AI browsers gain adoption and Chrome and Edge represent 70% of browser market share, millions of users could face risk if appropriate guardrails are not implemented.
Index analysis
AI browsers are trained to complete tasks rather than be security aware, making them susceptible to social engineering attacks that convince them malicious actions are part of normal workflow.
Existing security solutions like EDRs and SASE/SSE have limited visibility into browser activities and cannot differentiate between user actions and AI browser actions since both originate from the same browser.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.