Blog Published: Jul 6, 2026

PerplexedBrowser Shows Why Agentic Browsers Need Session and Sink Boundaries

Zenity showed how a poisoned calendar invite could steer Perplexity Comet (Perplexity's agentic browser) inside an authenticated 1Password (a password manager) web session, reveal vault secrets, and exfiltrate them through ordinary browser requests. The core failure is not that a model read untrusted content; it is that untrusted content could influence an agent that also held sensitive authenticated browser state.

Indirect Prompt InjectionData ExfiltrationTool AuthorizationSession IsolationAgentic AI
7 applicable AIDEFEND defenses
Source: PerplexedBrowser: How Attackers Can Weaponize Comet to Take Over Your 1Password Vault 
Author: Stav Cohen
Original article: Mar 3, 2026

Threat Analysis

  • The malicious instruction arrives through trusted workflow content. A calendar invite or similar external artifact carries indirect prompt injection into the browsing task.
  • The agent crosses from reading to acting inside a sensitive session. Comet can navigate authenticated 1Password pages, making browser state and user credentials part of the agent boundary.
  • Secret reveal is a high-impact action. A vault item is not ordinary page text; it should require origin-aware authorization and user confirmation before an agent can reveal or copy it.
  • Exfiltration uses normal browser capabilities. Once the agent sees the secret, ordinary web requests can carry it out unless sink enforcement constrains where sensitive values may flow.
  • The best mitigation is not prompt filtering alone. Sensitive origins need isolated browser contexts, cross-origin write controls, sink policies, and enterprise rules that disable agentic operation on high-risk sites.

Applicable AIDEFEND Defenses (7)

AID-I-008.001
Ephemeral Browser Context Lifecycle & Storage Partitioning
Very High
Ephemeral browser contexts and trust-zone storage partitioning directly prevent a task that reads untrusted content from sharing authenticated 1Password state.
AID-I-008.002
Cross-Origin Read/Write Segmentation with Step-Up Confirmation
Very High
Cross-origin read/write segmentation with step-up confirmation is the best fit for preventing an agent from moving secrets from a vault origin to an unrelated destination.
AID-H-019.003
Browser Runtime Admission & Sanitized Observation Export Gate
Very High
Run Comet inside an externally enforced browser sandbox that never mounts the user's daily browser profile, password-manager state, host credential cache, or persistent download directory. Bind each task to an egress policy outside the browser process and export only sanitized observations. Without the authenticated 1Password session inside the agent workspace, the poisoned invite cannot turn ordinary calendar handling into vault access and secret exfiltration.
AID-H-017.003
Decoupled Plan-Then-Execute Architecture
High
A decoupled plan-then-execute architecture gives defenders a place to reject actions that were planned from untrusted content before browser side effects happen.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
High
Value-level capability metadata and sink enforcement label vault secrets as sensitive values and block their flow to model calls, URLs, messages, or unrelated origins.
AID-H-002.002
Inference-Time Prompt & Input Validation
Medium
Prompt and input validation can detect obvious malicious instructions in invites or webpages, but it should be treated as a supporting layer because indirect prompt injection can be subtle.
AID-D-003.002
Sensitive Information & Data Leakage Detection
Medium
Scan model-generated browser navigations, tool arguments, and responses for secret-shaped vault values before release. This detector can emit a leakage finding, but AID-H-018.005 and AID-I-008.002 own prevention before the value leaves the vault context.

What Defenders Should Do Now

  • Disable autonomous browser agents on password managers, identity portals, admin consoles, and financial systems unless origin-aware policy is enforced.
  • Run untrusted browsing tasks in browser contexts that cannot reuse authenticated state for sensitive origins.
  • Require step-up confirmation before an agent reveals, copies, downloads, or sends secrets from a vault or identity application.
  • Tag sensitive values and block their movement to external URLs, messages, screenshots, and model calls unless policy explicitly allows it.
  • Review enterprise browser-agent policy for blocked domains, session isolation, audit logs, and prompt-injection telemetry.

Conclusion

The Comet case is important because it moves browser-agent safety from a model problem to a session-boundary problem. A browser agent that reads untrusted content and acts inside an authenticated vault is holding two incompatible trust zones at once. Separate the zones, constrain sensitive sinks, and make secret reveal a deliberate action, not a model convenience.