A Data-stealing Comet hurtles towards the Bureau
- Javier Conejo del Cerro
- 6 oct
- 4 Min. de lectura
Actualizado: 15 oct
A celestial threat has entered orbit. The attack known as CometJacking turns Perplexity’s Comet AI browser — an “agentic” browser designed to assist users through AI integration — into an insider threat with just a single click. Researchers at LayerX revealed that malicious URLs can embed hidden prompts that command Comet to extract sensitive data from connected accounts such as Gmail and Calendar, encode it in Base64, and send it to a remote server under attacker control.
No credential theft, no malware download — just social engineering and the AI agent’s own permissions weaponized against the user. The case exposes the fragility of AI-native browsers and the new category of threats emerging where AI autonomy meets enterprise data access.
Phase 1: Prompt Injection from Orbit
The attack begins innocently: a user receives a weaponized URL in an email, chat message, or web link. The URL looks legitimate, but it conceals a hidden instruction using Comet’s “collection” parameter. Instead of performing a normal search, Comet interprets this parameter as a command prompt.
Once clicked, the AI browser doesn’t just open a page — it executes code. The injected prompt tells Comet to query its memory, retrieve data from integrated services like Gmail or Google Calendar, encode it using Base64, and send it to an attacker-controlled endpoint. Because the browser already has authorized tokens for these services, the attacker doesn’t need to steal passwords or cookies; they simply commandeer the assistant.
The genius — and danger — of CometJacking lies in its simplicity: the entire breach chain is triggered by a single user click, bypassing conventional defenses that assume user intent and browser compartmentalization.
Phase 2: Inside the AI’s Memory Core
Once triggered, CometJacking exploits the very autonomy that makes AI browsers appealing. Unlike traditional browsers, Comet maintains an agentic memory that persists across tabs and sessions. This allows it to provide contextual responses but also makes it a repository of sensitive data.
By invoking this memory through a crafted prompt, the attacker forces Comet to act as a data retrieval agent, accessing cached information, recent queries, and linked cloud services. All of this occurs within the AI layer itself, invisible to endpoint security tools that monitor human input or downloaded files.
Even advanced DLP and CASB systems may fail to detect the exfiltration, as the communication appears as a legitimate outbound request by the browser to a trusted domain. The Base64 encoding masks the payload, and the transmission uses the same HTTPS tunnels as any normal AI query. The result: silent, authenticated exfiltration of data through an interface designed for assistance.
Phase 3: From Copilot to Command-and-Control
At this stage, the AI browser itself becomes a C2 node — a command-and-control point operating within the corporate perimeter. Since the agent executes natural language prompts, the attacker doesn’t need to inject code in the traditional sense; they issue linguistic commands that the model interprets as legitimate actions.
In this sense, CometJacking redefines the concept of exploitation: instead of hijacking the software, the attacker hijacks the intention of the AI. The AI executes orders exactly as it was built to do — only now, those orders come from an adversary masquerading as a trusted query.
LayerX researchers emphasized that trivial Base64 obfuscation was enough to bypass data exfiltration checks within the AI agent. Once the data is encoded and transmitted, detection tools fail to distinguish it from ordinary encoded API calls or serialized prompts. The attacker effectively transforms a business productivity tool into a corporate spy — without leaving forensic traces in logs or triggering endpoint alerts.
Phase 4: A New Frontier of Victims
Unlike traditional phishing or credential theft, CometJacking preys on a different kind of user — those who trust automation. Victims include administrators, executives, legal departments, financial teams, and developers who integrate Comet into their workflows for productivity.
These professionals often connect Comet with enterprise services (email, calendars, cloud drives) that hold privileged data. This makes every authorized integration a potential exfiltration channel.
In essence, CometJacking turns trust into vulnerability. The very users who benefit most from AI productivity — those handling sensitive data — are the ones who stand to lose the most when their assistant becomes the attacker.
Phase 5: Countermeasures and AI Browser Governance
Defending against CometJacking requires rethinking browser security for AI-native environments. Traditional controls like URL filtering or antivirus scanning are insufficient because the malicious content resides in prompts, not code.
To mitigate:
Limit AI browser privileges to the minimum necessary for productivity.
Disable or restrict memory recall in sensitive contexts so the AI cannot reference or access previous data autonomously.
Block or inspect Base64 traffic at gateways to detect encoded data exfiltration attempts.
Monitor agent-originated outbound traffic — treat AI-driven network requests as high-risk until validated.
Implement prompt governance and user training, teaching employees to distrust unsolicited AI interactions or unknown links, even those appearing benign.
Most importantly, enterprises must treat AI browsers as privileged endpoints, with dedicated access policies, visibility tools, and isolation layers to prevent lateral movement from an AI agent to corporate data.
CometJacking is not just a technical curiosity — it’s a glimpse into the emerging frontier of AI-native exploitation. It demonstrates how the convergence of autonomous agents, persistent memory, and trusted integrations opens entirely new vectors for data theft.
The key lesson is not merely to patch Comet, but to redesign AI governance around the reality that assistants now act as autonomous users within networks. This means auditing their behavior, constraining their permissions, and engineering security-by-design for the agentic layer itself.
The next generation of cyber threats will not steal your passwords — they’ll convince your AI to give them up voluntarily.
The Hacker News
Comentarios