PromptFix attacks expose critical vulnerabilities in agentic AI browsers
Security researchers demonstrated that Perplexity's Comet AI browser is vulnerable to PromptFix attacks that exploit its agentic design to bypass authentication checks, steal financial information, and bypass CAPTCHA protections. The vulnerabilities allow attackers to trick the browser into completing fraudulent transactions and enable potential large-scale attacks.
What happened
Security researchers at Guardio tested Perplexity's Comet AI browser and identified a new attack vector called PromptFix that exploits agentic AI systems by embedding malicious instructions within web content.
The researchers demonstrated that Comet failed to authenticate a fake Walmart listing using a bogus URL (walmart-cart-cash.lovable.app) and automatically filled in the user's credit card information and address to complete a fraudulent checkout. Comet also failed to identify phishing emails from fake banking sites and accepted malicious links without verification.
A prompt injection attack was shown to bypass CAPTCHA systems that are supposed to require human user intervention, potentially enabling distributed attacks to hijack browsers at scale.
Reported impact
The Comet browser's failure to validate website authenticity and detect phishing attempts creates a direct risk that users' personal and financial information could be compromised through fraudulent transactions and credential theft.
The ability to bypass CAPTCHA protections through prompt injection could enable attackers to hijack browsers en masse for coordinated attacks against targets.
Index analysis
The PromptFix attack represents an evolution of traditional ClickFix scams, adapted specifically to manipulate agentic AI systems rather than human users, exploiting the inherent trust and lack of critical validation in AI-powered browsers.
The vulnerabilities expose fundamental gaps in Comet's security architecture, including absence of basic guardrails before allowing the system to process sensitive personal information and execute financial transactions.
Governance controls
Comet launched in July 2025 behind Perplexity's $200 paywall with plans to make it free at some point, though no security certification or third-party audit was mentioned prior to public release.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.