HashJack prompt injection exploits AI browser vulnerabilities
Researchers discovered that AI browsers including Perplexity Comet can be manipulated through hidden URL fragments to perform unauthorized actions. The vulnerability allows attackers to inject malicious commands that exploit the AI's inability to distinguish legitimate requests from hidden malicious inputs, potentially exposing users to data theft and account compromise.
What happened
Researchers discovered that AI browsers including Perplexity Comet can be exploited through hidden URL fragments, such as a hashtag (#), to manipulate AI assistants without user knowledge. Attackers can embed malicious commands in seemingly harmless web content to perform prompt injection attacks.
SquareX disclosed that attackers could exploit Comet's architecture by gaining control of the perplexity.ai domain or compromising its extension, allowing them to execute unauthorized commands such as extracting sensitive data or manipulating connected accounts without the user's knowledge.
Reported impact
AI assistants transmit sensitive data to external endpoints automatically, and misleading guidance and fake links can appear on otherwise normal websites. Attackers could use compromised browsers for data theft, account takeovers, or ransomware deployment.
Index analysis
The vulnerability affects AI browsers that autonomously execute tasks such as filling forms, extracting data, and executing workflows, which require deep integration with users' digital lives including access to emails, calendars, contacts, and sometimes corporate databases. The more powerful these systems become, the greater the security risks posed by their flaws.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.