AIDEFEND in Action AIA-0045 Validated Research Published: Jul 7, 2026

PerplexedBrowser: When an Agent Browser Can Read Local Files

In Zenity's controlled demonstration with two test accounts and a dummy local credentials file, a poisoned calendar invite steered Perplexity Comet through an attacker site to local file navigation, then exfiltrated file contents in URL query parameters. An initial file:// block was bypassed with view-source:file://; Zenity verified an additional fix on February 13, before its March 3 publication.

Indirect Prompt InjectionData ExfiltrationSession IsolationAgentic AIWeb Security
4 applicable AIDEFEND defenses
Source: PerplexedBrowser: Perplexity's Agent Browser Can Leak Your PC's Local Files 
Author: Stav Cohen
Original article: Mar 3, 2026

Threat Analysis

  • The entry point is normal workflow content. A calendar invite contains benign meeting text plus hidden prompt-injection content that Comet reads when the user asks it to accept the meeting.
  • The agent is routed through attacker-controlled instructions. Fake button-like markup and system-reminder-style phrasing steer Comet to an external site in background mode.
  • The dangerous boundary is local file access. The site redirects Comet to a file:// path, then frames directory traversal and file reading as part of the task.
  • The exfiltration path is ordinary browsing. Once file contents enter agent context, Comet can place them in a URL and navigate to an attacker-controlled endpoint. No special exfiltration API is needed.
  • The strongest fix is an execution boundary. Prompt filtering may catch obvious payloads, but the durable control is to deny autonomous agent access to local filesystem schemes unless a trusted, explicit policy grants it.

Applicable AIDEFEND Defenses (4)

AID-H-017.003
Decoupled Plan-Then-Execute Architecture
High
A plan validator gives the system a checkpoint before side effects. It can reject a plan that turns calendar acceptance into background web navigation and local file access. This requires an operator-controlled planner and an independently enforced selector with trusted task policy; it is not an established stock Comet capability.
AID-H-019.003
Browser Runtime Admission & Sanitized Observation Export Gate
Medium
In a redesigned controlled runtime, admit each agent-requested navigation as its own task and apply G001 before dereferencing its start URL: the published gate accepts only an approved HTTP(S) origin and rejects file:// or view-source: start URLs. Independently bind and verify isolation/egress receipts. This is conditional start-URL admission, not a general host-filesystem or in-page-navigation policy; every native navigation route needs verified coverage, and no Comet integration is established.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Medium
If local file contents enter runtime values, they should be labeled by provenance and sensitivity. Those values must not flow into external URLs, image sources, forms, model calls, or other outbound sinks. This requires a controlled runtime with authenticated source/content bindings for every derived value, complete sink coverage and fail-closed unknown labels. One ingress label does not track arbitrary model rewriting. Native processes, browser requests and allowed destinations need separately verified coverage; stock SaaS deployment is not established.
AID-D-003.005
Stateful Session Monitoring: Intent Drift + Invariant-Breach Signals
Medium
Monitoring can catch the session drift from accepting a meeting to opening external instructions, browsing local files, and generating an outbound URL. It supports containment, but should not be the only control.

What Defenders Should Do Now

  • Block autonomous browser agents from using file://, loopback admin pages, password managers, identity portals, and local developer resources unless an explicit trusted workflow grants access.
  • Run calendar, email, webpage, and document content through content demotion before it reaches a tool-capable agent planner.
  • Validate each browser action against the trusted task and exact destination/resource policy. A signed tool-name scope alone cannot distinguish file access within an allowed browser operation.
  • Tag local-file data and block it from external URLs, messages, screenshots, model calls, and remote media loads.
  • Add detections for untrusted content followed by background navigation, file:// access, local-file reads, and unusual outbound URLs.

1 additional consideration

Native browser navigation and local-file policy

The published H-019.001 method is a pinned HTTPS retrieval service, not a native Comet file-navigation interceptor. H-018.004 grants tool names and cannot distinguish destinations within one allowed browser operation. Neither is credited here as enforcing the vendor's file-navigation fix.
Recommendation: Verify a browser-native gate that rejects all unapproved local-file navigation paths, including nested view-source wrappers, before dereference. Test the exact reported bypass and preserve isolation and data-flow controls separately.

Conclusion

This controlled case shows how untrusted calendar content can steer an agent across the local-file boundary. Relevant defenses need to cover browser-native navigation paths, independent runtime isolation and data-aware outbound controls. Tool-name grants and a safe HTTPS fetch service do not automatically enforce native browser paths; the exact file:// and view-source:file:// routes must be tested.

Last updated: