Brave reports that Comet could read faint, low-contrast text embedded in images when a user asked about a screenshot, and that Fellou sent visited page text to its model on simple navigation, letting on-page instructions override user intent. Brave argues both let untrusted content trigger actions under the user's authenticated sessions.
Why it matters
Injection surfaces in agentic browsers extend beyond page text to images and routine navigation.
Key facts
As stated in the sources, with where to find them.
- Disclosure windows: Perplexity 2025-10-01 to 2025-10-21; Fellou 2025-08-20 to 2025-10-21.Disclosure timeline
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Aug 20, 2025
Oct 31, 2025
Nov 20, 2025
Oct 8, 2025
Aug 6, 2025
Jul 8, 2025