Zero-Click Prompt Injection in Perplexity Comet Enables Credential Theft
Researchers discovered a zero-click prompt injection vulnerability in Perplexity's Comet AI browser that could allow attackers to steal passwords and account credentials through malicious calendar invitations. The flaw exploits the browser's autonomous execution model to exfiltrate sensitive data and compromise integrated password managers like 1Password without user awareness. Perplexity and 1Password issued patches and mitigations after responsible disclosure.
What happened
Zenity Labs researchers uncovered a family of vulnerabilities called 'PleaseFix' affecting agentic browsers including Perplexity's Comet browser, which can enable zero-click agent hijacking and data exfiltration through indirect prompt injection.
Malicious calendar invitations could trigger Comet to access the local file system and exfiltrate data while continuing to return expected results to the user, without requiring user clicks or explicit requests for sensitive actions.
In authenticated 1Password web sessions, the Comet agent could navigate vault entries, reveal stored usernames and passwords, and exfiltrate them through ordinary web requests, or navigate to account settings and change the master password to an attacker-controlled value.
Reported impact
The vulnerabilities could enable attackers to compromise 1Password user accounts and extract stored credentials, potentially enabling rapid downstream compromise of other services that rely on the password manager.
The flaw demonstrates an 'agent trust failure' where untrusted content can influence an AI agent to take sensitive actions without user awareness.
Index analysis
The vulnerability affects agentic browsers that autonomously execute tasks across applications, introducing a new class of security risk distinct from traditional web browser threats.
The attack exploits indirect prompt injection embedded in untrusted content such as calendar invitations to manipulate the agent's behavior without user interaction.
Governance controls
Perplexity addressed the underlying browser-side execution issue and introduced stricter user confirmation for sensitive actions and enterprise controls allowing administrators to disable the agent on designated sites.
1Password acknowledged the ecosystem-level risk and introduced new hardening options.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.