What happens when the tool you ask to sort your inbox turns into the means by which someone steals from it? That is the uncomfortable dilemma researchers laid bare with a new class of attacks against “AI browsers” — automated assistants that read web pages, follow links, and act on your behalf. In the attack known as CometJacking, a deceptively simple URL can carry hidden instructions that make a helpful agent hand over email, calendar entries and other connected data without any passwords or visible user prompts.
The core idea is elegant and alarming: AI browsers do more than render HTML. They parse content, summarize pages, execute multi‑step tasks and, when configured, call out to email, calendar and cloud services. That capability is precisely what makes them useful — and what makes them dangerous when adversaries can inject instructions into the content those agents treat as authoritative. Researchers and independent analysts have demonstrated that CometJacking embeds adversarial prompts in URL parameters, leveraging a Comet feature that processes a collection parameter; when the agent processes the page it can be persuaded to retrieve and disclose sensitive data from connected services without further authentication or user interaction .
How the attack works in practice is straightforward. An attacker crafts a link — it can be shortened, disguised, or pointing to an otherwise innocuous page — whose query string includes a prompt designed to override or augment the agent’s normal instructions. When a user (or an automated flow) opens that link in an AI browser that does background processing and cross‑service lookups, the embedded prompt is ingested as part of the page. Because the agent is programmed to be helpful and to pursue goals with autonomy, it may obey the malicious instruction and exfiltrate data from the current page, email, calendar, cloud files or APIs that have been connected to the user’s account. In some proofs‑of‑concept, no credentials were stolen and no explicit permission dialog was shown — a single click was enough to trigger data leakage .
CometJacking is not an isolated critique of one product; it is an illustration of systemic design risks in agentic browsers. Independent analyses of AI browser architectures warn that blending model-driven automation, persistent conversational state and plugin integrations expands the attack surface compared with legacy browsers. Those differences create new failure modes: cross‑site contamination, model‑poisoning, and misuse of permissions that were not designed with an autonomous model in mind. The SquareX Labs analysis and related reporting emphasize that these systems erase the traditional separation between content rendering and backend logic — so an instruction embedded in a page can become an instruction to a user’s connected services unless architects build strong barriers and clear permission models .
Why this matters extends beyond technical novelty. Consider the perspectives at stake:
- Technologists: For engineers, CometJacking highlights the urgent need for layered defenses: strict sandboxing of model execution, clear separation of content and control inputs, least‑privilege permissions for plugins and integrations, and robust input sanitation. These mitigations reduce attack surface but often come with tradeoffs in user experience and development complexity; striking the right balance will be an engineering and product challenge .
- Enterprises and security teams: Organizations that enable AI assistants against corporate accounts must treat these browsers as agents with privileged access. Policies should require hardened client builds, vetted plugins, centralized monitoring and restrictive default permissions. The potential for cross‑service exfiltration makes incident response more complex, since an agent could aggregate and forward data across multiple systems in ways legacy tooling did not anticipate .
- Policymakers and regulators: The opacity of model behavior and the potential for silent data disclosures raise regulatory questions about consent, notice and liability. Should vendors be required to surface the provenance and scope of agent actions? Must there be standardized controls for agent autonomy when handling personal data? These are live policy debates with technical nuances that call for informed, collaborative rulemaking .
- Users and privacy advocates: Ordinary users expect links to be safe or at least to prompt before sensitive actions occur. CometJacking breaks that expectation. Until agents enforce clearer consent boundaries and explain their actions, users should be cautious about opening unfamiliar links while developers roll out fixes and tighten permission models .
- Adversaries: For attackers, agentic features are an attractive vector: low friction, high reward, and plausible deniability. Crafting a malicious URL that relies on the agent’s own helpfulness flips the interaction model against the user.
Several practical mitigations are already recommended by security practitioners. They include treating web content and control instructions as separate inputs — ignore or strictly validate likely‑instruction constructs embedded in pages; implement explicit consent flows for cross‑service operations; enforce least‑privilege access for plugins and connected accounts; and adopt tamper‑resistant logging and telemetry so suspicious agent behavior can be detected and audited. Vendors have begun responding to disclosed issues with patches and guidance, but researchers caution that technical fixes alone are not enough: design principles, policy guardrails and user education must evolve together to keep pace with agentic capabilities .
There are tradeoffs. Sandboxing reduces the risk that a malicious prompt will access connected services, but it can also blunt the convenience that makes AI browsers compelling. Fine‑grained permissions protect data but may degrade the seamless workflow users want. Transparent logging aids investigation but raises privacy questions about what should be recorded when an agent touches a user’s email or calendar. The right path forward will require iteration and, importantly, sober communication from vendors about residual risks so users and organizations can make informed choices .
CometJacking is a practical demonstration of a theoretical vulnerability: when you give an automated agent the authority to act across services, you must assume adversaries will probe the boundaries. The lesson is clear and inconvenient — convenience without careful confinement invites compromise. As AI browsers evolve, builders must decide which they value more: an agent that is unfettered and fast, or one that is constrained and safe. Until that engineering and governance tradeoff is resolved, the safest course for many users and organizations will be caution: update clients, review and tighten agent permissions, and treat unfamiliar links with the same suspicion you would a suspicious attachment .
How much autonomy should we trust to a software assistant that reads, thinks and acts for us? The answer will shape not only product roadmaps and corporate policies, but also how much of our private lives we are willing to let an algorithm access without continual human oversight.
Source: https://www.schneier.com/blog/archives/2025/11/prompt-injection-in-ai-browsers.html
