AIDEFEND in Action AIA-0040 Validated Research Published: Jul 6, 2026

PerplexedBrowser Shows Why Agentic Browsers Need Session and Sink Boundaries

Zenity's controlled demonstration steered Perplexity Comet from a poisoned calendar invite into an unlocked 1Password extension and authenticated vault session. It revealed vault values and exfiltrated them in URL parameters; a second route changed the account password and extracted the Secret Key from an emailed Emergency Kit. The browser agent inherited sensitive authenticated state while following untrusted workflow content.

Indirect Prompt InjectionData ExfiltrationTool AuthorizationSession IsolationAgentic AI
7 applicable AIDEFEND defenses
Source: PerplexedBrowser: How Attackers Can Weaponize Comet to Take Over Your 1Password Vault 
Author: Stav Cohen
Original article: Mar 3, 2026

Threat Analysis

  • The malicious instruction arrives through trusted workflow content. A calendar invite or similar external artifact carries indirect prompt injection into the browsing task.
  • The agent crosses from reading to acting inside a sensitive session. Comet can navigate authenticated 1Password pages, making browser state and user credentials part of the agent boundary.
  • Secret reveal is a high-impact action. A vault item is not ordinary page text; it should require origin-aware authorization and user confirmation before an agent can reveal or copy it.
  • Exfiltration uses normal browser capabilities. Once the agent sees the secret, ordinary web requests can carry it out unless sink enforcement constrains where sensitive values may flow.
  • The best mitigation is not prompt filtering alone. Sensitive origins need isolated browser contexts, cross-origin write controls, sink policies, and enterprise rules that disable agentic operation on high-risk sites.
  • Account takeover and vault exfiltration have different prerequisites. Zenity reports that MFA blocks a new attacker login and SSO prevents this self-service password-reset route; neither prevents data exfiltration from the already unlocked vault. On its March 3 publication, the researchers described opt-in 1Password autofill controls and Comet domain restrictions; this is a dated remediation account, not a claim about today's defaults.

Applicable AIDEFEND Defenses (7)

AID-I-008.001
Ephemeral Browser Context Lifecycle & Storage Partitioning
Very High
Ephemeral browser contexts and trust-zone storage partitioning directly prevent a task that reads untrusted content from sharing authenticated 1Password state.
AID-I-008.002
Cross-Origin Read/Write Segmentation with Step-Up Confirmation
High
In an independently controlled browser runtime, G002 can require confirmation for an observed, suspended password-change or other covered write request. The source does not establish such an integration in Comet. G001 resumes GET/HEAD/OPTIONS, so it does not stop the demonstrated URL-parameter exfiltration; no separate intercepted write request is established for merely revealing an existing vault value. Those read and exfiltration boundaries need separate controls.
AID-H-019.003
Browser Runtime Admission & Sanitized Observation Export Gate
High
Before an operator-controlled browser task starts, verify current task-bound receipts from I-008.001 and I-001.004 and an external sandbox attestor. Deny admission when host browser-profile or credential-cache reuse is reported, require an extension-disabled fresh context, and export only bounded sanitized observations. This admission/export gate consumes isolation and egress evidence; it does not create the sandbox or block packets. Comet must provide an independently verified runtime adapter; stock product support is not established.
AID-H-017.003
Decoupled Plan-Then-Execute Architecture
High
A decoupled plan-then-execute architecture gives defenders a place to reject actions that were planned from untrusted content before browser side effects happen. This requires an operator-controlled planner and an independently enforced selector with trusted task policy; it is not an established stock Comet capability.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Medium
Value-level capability metadata and sink enforcement label vault secrets as sensitive values and block their flow to model calls, URLs, messages, or unrelated origins. This requires a controlled runtime with authenticated source/content bindings for every derived value, complete sink coverage and fail-closed unknown labels. One ingress label does not track arbitrary model rewriting. Native processes, browser requests and allowed destinations need separately verified coverage; stock SaaS deployment is not established.
AID-H-002.002
Inference-Time Prompt & Input Validation
Medium
Prompt and input validation can detect obvious malicious instructions in invites or webpages, but it should be treated as a supporting layer because indirect prompt injection can be subtle.
AID-D-003.002
Sensitive Information & Data Leakage Detection
Medium
G001 can inspect an observable model response or generated navigation/tool argument for configured protected vault literals and emit a content-bound leakage finding. It does not track arbitrary secret rewriting or block delivery by itself; an independently enforced sink or admission gate must consume the finding. The browser write-confirmation method does not stop the demonstrated GET exfiltration.

What Defenders Should Do Now

  • Disable autonomous browser agents on password managers, identity portals, admin consoles, and financial systems unless origin-aware policy is enforced.
  • Run untrusted browsing tasks in browser contexts that cannot reuse authenticated state for sensitive origins.
  • Require step-up confirmation before an agent reveals, copies, downloads, or sends secrets from a vault or identity application.
  • Tag sensitive values and block their movement to external URLs, messages, screenshots, and model calls unless policy explicitly allows it.
  • Review enterprise browser-agent policy for blocked domains, session isolation, audit logs, and prompt-injection telemetry.

Conclusion

The Comet case is important because it moves browser-agent safety from a model problem to a session-boundary problem. A browser agent that reads untrusted content and acts inside an authenticated vault is holding two incompatible trust zones at once. Separate the zones, constrain sensitive sinks, and make secret reveal a deliberate action, not a model convenience.

Last updated: