Blog Published: Jul 7, 2026

PerplexedBrowser: When an Agent Browser Can Read Local Files

Zenity showed a zero-click path where a calendar invite steers Perplexity Comet (Perplexity's agentic browser) into an attacker-controlled background site, then into local file:// paths, and finally into exfiltrating file contents through ordinary browser navigation. The vendor fix, a hard block on agent access to file://, is the right kind of boundary: deterministic, not a prompt-level guess.

Indirect Prompt InjectionData ExfiltrationSession IsolationAgentic AIWeb Security
6 applicable AIDEFEND defenses
Source: PerplexedBrowser: Perplexity's Agent Browser Can Leak Your PC's Local Files 
Author: Stav Cohen
Original article: Mar 3, 2026

Threat Analysis

  • The entry point is normal workflow content. A calendar invite contains benign meeting text plus hidden prompt-injection content that Comet reads when the user asks it to accept the meeting.
  • The agent is routed through attacker-controlled instructions. Fake button-like markup and system-reminder-style phrasing steer Comet to an external site in background mode.
  • The dangerous boundary is local file access. The site redirects Comet to a file:// path, then frames directory traversal and file reading as part of the task.
  • The exfiltration path is ordinary browsing. Once file contents enter agent context, Comet can place them in a URL and navigate to an attacker-controlled endpoint. No special exfiltration API is needed.
  • The strongest fix is an execution boundary. Prompt filtering may catch obvious payloads, but the durable control is to deny autonomous agent access to local filesystem schemes unless a trusted, explicit policy grants it.

Applicable AIDEFEND Defenses (6)

AID-H-018.004
Intent-Based Dynamic Capability Scoping
Very High
The user's trusted request is to accept a meeting. A signed per-request scope should allow calendar handling but deny local filesystem browsing, directory traversal, and background navigation that is justified only by invite text.
AID-H-019.001
URL Normalization & Allowlist Filtering
Very High
Agent-initiated navigation should pass through a safe navigation wrapper that rejects file:// and other non-approved schemes before the browser agent dereferences a local path.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Very High
If local file contents enter runtime values, they should be labeled by provenance and sensitivity. Those values must not flow into external URLs, image sources, forms, model calls, or other outbound sinks.
AID-H-019.003
Browser Runtime Admission & Sanitized Observation Export Gate
Very High
Place the agent browser in a sandbox with no host profile or unscoped host filesystem mounts, and force all outbound traffic through an externally enforced egress policy that blocks loopback, private addresses, and unapproved destinations. Even if the page influences planning, the browser cannot dereference host files or send their contents to the attacker's site.
AID-H-017.003
Decoupled Plan-Then-Execute Architecture
High
A plan validator gives the system a checkpoint before side effects. It can reject a plan that turns calendar acceptance into background web navigation and local file access.
AID-D-003.005
Stateful Session Monitoring: Intent Drift + Invariant-Breach Signals
Medium
Monitoring can catch the session drift from accepting a meeting to opening external instructions, browsing local files, and generating an outbound URL. It supports containment, but should not be the only control.

What Defenders Should Do Now

  • Block autonomous browser agents from using file://, loopback admin pages, password managers, identity portals, and local developer resources unless an explicit trusted workflow grants access.
  • Run calendar, email, webpage, and document content through content demotion before it reaches a tool-capable agent planner.
  • Make browser-agent actions go through a plan validator and a signed per-request capability scope. Meeting acceptance should not imply local file access.
  • Tag local-file data and block it from external URLs, messages, screenshots, model calls, and remote media loads.
  • Add detections for untrusted content followed by background navigation, file:// access, local-file reads, and unusual outbound URLs.

Conclusion

This case is not about a model making a bad wording choice. It is about an agent holding browser power, local file visibility, and untrusted workflow content in the same execution path. The practical lesson is to put hard boundaries around schemes, scopes, and data sinks before the agent acts.