Inside Comet's trust problem — and the rebuild

Comet is Perplexity's agentic browser: an AI that doesn't just answer but acts — navigating pages, completing multi-step tasks, and operating inside authenticated sessions on your behalf. After launching at a premium, it moved to free, putting autonomous browsing in a lot of hands. The promise is real leverage: hand off the tedious multi-tab chores and let the agent finish them.

We picked it because the category's entire future rides on one question — can an agent with your privileges be trusted with untrusted web content? — and Comet is where that question is being stress-tested in public.

The capability is genuinely impressive. Interpreting the DOM, executing actions, and chaining steps across sites is hard, and Comet does it well enough that the leverage is obvious the first time it completes a real task. Going free was an aggressive, category-defining distribution move. And the underlying answer-engine DNA — synthesizing across sources — is a strong foundation for an agent that has to reason about what it's reading.

When it works and the content is benign, it's a preview of how a lot of web work gets done in a few years. The problem is the "when the content is benign" clause.

The same-origin policy collapses to the quality of the injection defense

The web's foundational security boundary assumes code from one site can't act on another. An agent with your session privileges, taking instructions from page content, quietly dissolves that boundary: independent research shows that across multiple agentic browsers, a successful prompt injection re-enables cross-origin data theft that decades of browser security were built to prevent. The browser's safety is now only as good as its ability to tell your instructions from a webpage's.

Documented, serious exploits

Security researchers (Brave, Zenity, and others) demonstrated indirect prompt injection against Comet — including paths to operating inside an authenticated password-manager session and zero-click compromise via something as mundane as a malicious calendar invite, all while returning normal-looking output to the user. Fixes have been issued, but the pattern is structural, not a one-off bug.

Hidden-instruction surface is enormous

Injection can hide in white-on-white text, sub-pixel fonts, zero-width characters, CSS-positioned content — anything the model reads but the user can't see. In one comparison, an agentic browser blocked a small fraction of malicious pages where traditional browsers blocked roughly half. You can't fully sanitize the open web.

The market and regulators have noticed

A court blocked Comet's agent from acting in Amazon accounts, establishing that user permission to an agent isn't the same as platform authorization — and analysts have advised enterprises to block AI browsers outright over injection risk. Even OpenAI's security leadership has called prompt injection a frontier, unsolved problem. The capability is shipping ahead of the trust model.

You cannot eliminate prompt injection at the model layer. So we wouldn't try. We'd rebuild the browser so that a successful injection can't reach anything that matters — trust becomes an architecture property, not a model promise.

1. Separate trusted intent from untrusted content

The user's instruction travels in one channel; page content is treated as data to be analyzed, never as commands. This is the single most important fix and the one most products skip.

2. Gate every consequential action

Reading is low-risk; acting (sending, buying, changing settings, moving money, cross-origin requests) passes through a policy layer with explicit, scoped permission. Default-deny on the dangerous verbs.

3. Least-privilege, per-task credentials

The agent never inherits your whole logged-in identity. It gets scoped, time-boxed access to the specific thing the task needs, so a hijack can't pivot into your password manager or email.

4. Confirm the irreversible

Anything that moves money, sends a message, or changes credentials requires a human tap — clearly summarized. Friction in exactly the right place.

What we'd cut, and how we'd ship it.

Twelve months out, agentic browsing is too useful to disappear and too dangerous to ship the way it's shipping now. We expect the winners to be defined by their trust architecture, not their capability — the products that treat the open web as hostile by default and build real boundaries around what an agent can do. Regulators and enterprise security teams are going to force this; the only question is who gets there before an incident does it for them.

A remarkable capability sitting on a trust model the web's own security history says can't hold. The fix isn't a smarter model — it's an architecture where a successful injection reaches nothing worth stealing. That's buildable. It's mostly just not built yet.