CometJacking: One Click Can Turn Perplexity’s Comet AI Browser Into a Data Thief
Source Reddit InfoSec News
Germany
France
Netherlands
Sweden
Finland
Belgium
Italy
United Kingdom- infosecnews
- high-priority
- thehackernews.com
- cybersecurity
Description
CometJacking: One Click Can Turn Perplexity’s Comet AI Browser Into a Data Thief Source: https://thehackernews.com/2025/10/cometjacking-one-click-can-turn.html
Impact
For European organizations, the CometJacking threat poses a substantial risk to confidentiality and privacy, especially for entities leveraging the Comet AI Browser for research, customer interaction, or internal workflows involving sensitive data. The potential data theft could lead to exposure of intellectual property, personal data protected under GDPR, or credentials that facilitate further network compromise. Given the browser's AI capabilities, stolen data might include sensitive AI-generated insights or queries, compounding the impact. Organizations in sectors such as finance, healthcare, legal, and technology—where data sensitivity is paramount—could face regulatory penalties, reputational damage, and operational disruption if exploited. Additionally, the ease of exploitation via a single click increases the likelihood of successful phishing or social engineering campaigns targeting employees. The threat could also undermine trust in AI-enhanced tools, slowing adoption of innovative technologies. Since no patches or mitigations are currently linked, organizations must proactively assess their exposure and implement compensating controls to prevent data leakage. The absence of known exploits in the wild provides a window for preemptive defense, but also underscores the need for vigilance as attackers may develop exploits rapidly.
Defensive guidance
To mitigate the CometJacking threat, European organizations should first inventory and assess the use of the Comet AI Browser within their environment, limiting its deployment to trusted users and scenarios. Implement strict browser usage policies that restrict installation of unverified extensions or plugins that could facilitate exploitation. Employ network-level controls such as web filtering and DNS filtering to block access to known malicious URLs or phishing sites that could trigger the one-click exploit. Enhance endpoint security with behavioral detection capable of identifying anomalous data exfiltration patterns originating from the browser process. Conduct targeted user awareness training emphasizing the risks of clicking unsolicited links or buttons, particularly in AI-powered browsing contexts. Monitor for unusual outbound traffic from endpoints using the Comet AI Browser, and consider deploying Data Loss Prevention (DLP) solutions to detect and block unauthorized data transfers. Engage with Perplexity or the browser vendor for updates and patches, and apply them promptly once available. Until patches are released, consider isolating the browser usage within sandboxed or virtualized environments to contain potential breaches. Finally, integrate threat intelligence feeds to stay informed about emerging exploits related to CometJacking.
Summary
The security threat dubbed "CometJacking" involves a vulnerability or exploit vector targeting the Comet AI Browser developed by Perplexity. According to the information sourced from a recent article on The Hacker News and discussed on Reddit's InfoSecNews subreddit, this threat enables an attacker to transform the Comet AI Browser into a data thief with a single click. Although detailed technical specifics are limited, the implication is that a malicious actor can leverage a user interaction—likely clicking a crafted link or button—to execute unauthorized data exfiltration from the browser environment. This could involve stealing sensitive user data such as browsing history, cookies, authentication tokens, or other private information accessible within the browser context. The lack of affected version details and absence of known exploits in the wild suggests this is a newly discovered or emerging threat. The high severity rating indicates the potential for significant confidentiality breaches. The attack vector appears to require minimal user interaction (one click), which lowers the barrier for exploitation. Since this threat targets a specialized AI-powered browser, it may exploit unique features or integrations within the Comet AI Browser that differ from traditional browsers, such as AI query handling or data processing capabilities. Overall, CometJacking represents a critical risk to user privacy and data security by turning a trusted AI browsing tool into a conduit for data theft through a simple user action.
- Source Type
- Subreddit
- InfoSecNews
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Domain
- thehackernews.com
- Has External Source
- true
References
Community reviews
Related threats
- Transparent Tribe Launches New RAT Attacks Against Indian Government and AcademiaNews
- RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web ServersBotnet
- DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users WorldwideBreach
- Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm RegistryMalware
- U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator SpywareNews