Comet Prompt Injection: Every Recommended Control Shipped, and Here Is What Still Landed

Comet has the best-documented defense program in agent security, and the documentation is worth more than the incidents.

Three separate parties published on the same system. Trail of Bits, hired to test the browser before it launched, published its threat model and the five recommendations it handed over. Perplexity published the defense architecture it shipped and then co-authored a benchmark measuring a detection layer for browser agents. Brave published working attacks against the browser after launch, first through page content and later through screenshots.

Nobody is going to do this for the agent your team deployed last quarter. There will be no published threat model of your retrieval service, no benchmark of your tool layer, no disclosure post when somebody walks it. The record around Comet is therefore the closest thing available to a controlled test of the pre-deployment checklist most security teams are currently working from.

Read as news, it says a browser got broken. Read as an audit, it answers a harder question: what does a complete checklist leave open?

Comet Is the Only Browser Agent Whose Whole Defense Program Is Public

No other deployed agent has an auditor, a vendor and an independent breaker all publishing on the same system, which is why this record rewards close reading rather than reaction.

The sequence runs like this. Perplexity engaged Trail of Bits before Comet launched, and the audit produced four prompt injection techniques and a set of proof-of-concept exploits, each ending with Gmail contents leaving the user’s session. Perplexity closed those findings before shipping. Four months after launch, Brave disclosed a working injection reached through an ordinary summarize request. Two months later, Brave published a second round using payloads carried in screenshots. The following day, Perplexity published its layered defense. A month after that, Perplexity researchers released the benchmark. Fourteen months after the original engagement, the auditor published its side.

Every stage of that sequence is public and dated, which matters for reading the ledger below: some of the published defenses post-date some of the published breaks. What survives that objection is the third and fifth rows, where the evidence against the control comes from the vendor’s own current measurements rather than from a historical incident.

This is the most useful artifact in agent security right now. You do not have to speculate about whether the standard pre-deployment controls hold, and you do not have to run the experiment on your own production traffic to find out. Somebody already ran it, at scale, with a competent external auditor and a security team that publishes.

We have previously broken down the eight stages a production prompt injection runs through, from poisoned ingestion to exfiltration. The Comet record is that same chain with something rare attached: a documented list of which controls were standing at each point.

Every Control on the Standard Checklist Shipped

Trail of Bits closed its publication with five recommendations for any team putting an agent in front of untrusted content. Read them cold and they will sound familiar, because they sit close to what most AI security programs are currently measured against, and close to the three positions published injection defenses tend to occupy.

The table places each recommendation against the published evidence that Comet implemented it, and against what the public record shows landed anyway. Every cell traces to either the auditor’s publication or Perplexity’s own.

Recommended control	Published evidence of implementation	What landed against it
Threat-model the AI system before deployment	TRAIL threat model applied pre-launch; two trust zones mapped; tool-created data paths between them enumerated	Cross-tab data access through a summarize request, disclosed four months after launch (Aug 2025)
Separate system instructions from external content	Tool-level guardrails, external content demarcated as untrusted in prompts, intent reinforcement at routing (Oct 2025); tools capable of returning untrusted content declaratively flagged (Nov 2025)	Fake system-instruction and fake user-request framings both succeeded during the pre-launch audit; delimiter injection remains a live class in the vendor’s own benchmark taxonomy
Red-team with systematic injection testing	Benchmark of 14,719 samples across 11 attack types and 9 injection strategies, built from 100,000 anonymized production tool outputs; classifiers fed by bug bounty and red team findings	Benchmark F1 falls from 0.905 to 0.788 against injection placements held out of training
Apply least privilege to agent capabilities	Confirmation required for four enumerated action classes: sending emails or messages, modifying the calendar, placing final orders, and filling in user details the agent does not already hold	Every documented exfiltration completed through navigate, fetch, read and URL construction, none of which appear on that list
Treat retrieved input as untrusted and validate it	Raw retrieved content extracted and classified before it reaches the model, with model-generated annotations stripped first so classification runs on what the adversary controlled	Recall of 0.841 at a 1% false positive rate; balanced accuracy across evaluated models drops from 90.2% on clean samples to 81.2% once three benign distractor elements are present

Column two is complete. Column three is not empty.

That combination is the finding. This was not a team that skipped the work, and it was not a checklist executed badly. Every item shipped, and the attacks that survived all resolve to the same shape: the agent did things it was allowed to do, in an order nobody had reason to prohibit.

Three of Comet’s Four Layers Screen Content. The Fourth Gates Four Actions.

Perplexity’s published architecture has four layers, and the split between them decides what the whole stack can catch.

Layer 1 runs machine learning classifiers over retrieved content before it influences the assistant’s reasoning. Layer 2 inserts structured prompting at decision points, marking external content as untrusted and re-anchoring the model to the original request. Layer 4 notifies the user after something is blocked. Layer 3 pauses for human confirmation on sensitive actions.

Three of those operate on what enters the model. One operates on what leaves it.

Layer 3 is the only published control standing between the model’s decision and a consequence in the world, and its scope is enumerated rather than open: sending emails or messages, modifying the calendar, placing final orders, and any case where the agent needs details it does not already hold. Enumeration is a reasonable design choice, because confirming everything destroys the reason anyone deployed an agent. It is also the constraint, because a list of gated actions is simultaneously a list of ungated ones.

Now put the documented exploits next to that list.

The fragments exploit instructed the agent to assemble a page from three numbered fragments, then post the assembled result to a combining endpoint. Fragment one redirected to Gmail. The agent fetched all three, then navigated to the combining endpoint with the mail contents carried in a URL parameter. The action sequence is navigate, read, construct a URL, navigate.

The validator exploit introduced a fake policy requiring content to be checked before summarization. The agent encoded the current page and a second page that redirected to Gmail, then submitted both to a validation endpoint, which returned a confident-looking safe verdict while keeping the data. The sequence is read, encode, submit. The CAPTCHA exploit was shorter: visit an abuse-detection page that redirects to Gmail, copy the text, submit it for verification.

No email was sent. No calendar was modified. No order was placed. Not one of these sequences touches an action on the confirmation list, and each one ends with a user’s mailbox on somebody else’s server.

That is also why the entry path stops mattering once content is inside the context window. Whether the instruction was typed or retrieved, the downstream action sequence looks the same to every control downstream of the model.

The exits are wider than they look, too. Later category-level research into agentic browsers, published without naming the affected vendors, demonstrated exfiltration through a subdomain of an allowlisted domain over DNS and through search queries salted with low-frequency terms. An egress allowlist closes neither, which is the pattern running through the documented incidents where each vendor fix narrowed the exit and left the entry intact.

This is the same structural problem we described when a poisoned tool description redirects an approved tool by changing a single argument value. Approving an action does not bound what that action carries. And it is why capturing which tools an agent actually invoked, with what arguments, is a different problem from screening the text that reached it.

The Vendor Published the Residual, and It Has a Shape

Perplexity’s security lead and CTO are co-authors on the benchmark paper, which makes its numbers a rare thing: a vendor stating on the record what its own class of defense does not catch.

The purpose-built detector reported recall of 0.841 at a 1% false positive rate. Held-out testing put F1 at 0.788 against injection placements absent from training. Across the 20-plus models evaluated, balanced accuracy on clean samples ran at 90.2% and fell to 81.2% once three benign distractor elements were added. Production pages are never clean samples; hidden form fields, data attributes and HTML comments are ordinary web furniture.

The residual is not evenly spread, which matters more than its size. Detection held up well against attacks placed in hidden, non-rendered elements and degraded against attacks rewritten into visible page content, with the weakest results on footer and table-cell rewrites. It degraded again against payloads phrased without trigger vocabulary, dropping from 84.9% balanced accuracy on explicit phrasings to 74.6% on camouflaged ones. Attacks written in languages other than English scored lowest of the eleven categories tested.

So the payloads most likely to survive screening are the ones that read like the rest of the page. That is the opposite of the mental model most teams carry, which pictures injection as hidden white-on-white text, and it lines up with the blind spots that prompt-layer analysis carries in general.

Two boundaries are stated in the paper itself. Non-textual inputs, including image-borne payloads, sit outside what the benchmark measures, and Brave’s second round used exactly that modality. And the authors describe their detector as one component of a larger system that might also scan the arguments a model generates for its next tool call, which is the right instinct and is also the part with no published measurement attached. Mapping techniques to a catalog is worth doing for exactly this reason: it makes the unmeasured cells visible.

Your Agents Have the Same Shape and One Advantage Comet Never Had

The detection result is strong. It beat every general-purpose frontier model measured against the same benchmark, at sub-second latency, with zero refusals across 3,680 samples. Anyone arguing that content classification is worthless has not read the numbers. If you screen retrieved content today, keep screening it. OWASP has ranked prompt injection first since the list existed, and the UK’s NCSC has described the underlying problem as a confused deputy rather than an input-sanitization bug, which is a fair reading of why the residual will not go to zero.

The argument turns on where the residual lands, not on how large it is.

Here is the asymmetry that favours you. Perplexity does not own the machine its agent runs on. Its defenses have to work from inside the browser, on somebody else’s laptop, against a user who may be signed into a bank in another tab. If your agents run in clusters you operate, you own the layer underneath them, and that vantage point sits below everything described so far. The caveat is worth stating plainly: agents running on employee endpoints or inside third-party SaaS stay outside that reach, and they need a different control.

Inside infrastructure you run, the unit of security stops being the payload and becomes the agent. A kernel-level sensor records what each workload actually does: which processes it spawns, which files it opens, which network destinations it reaches, which identities it presents. That recording becomes a per-agent behavioral baseline, which ARMO calls Application Profile DNA (APD™). A retrieval agent that has read from one vector store and written to one internal API for three weeks has a narrow, well-shaped profile. When it navigates somewhere new and starts moving mailbox-shaped volumes of text into a URL, the deviation is legible even though every individual step was permitted.

That is what coercion looks like in telemetry. The credentials are valid, the tools are approved, the destinations may even be allowlisted, and the sequence is still not something this agent has ever done. It also matters at fleet scale, because a coerced agent that talks to other agents widens the blast radius well past the pod it started in.

Rolling this out without breaking production is the part teams get wrong. Run in Audit first and let the profile converge, so you can see what the policy would have blocked before it blocks anything, then promote to Enforce per agent once the audit trail shows the boundary is right. That sequencing exists because every agent arrives in production before its own history does, and we have written at length about why behavioral bounds hold where isolation bounds do not. The Comet record is the clearest public evidence for it: an agent inside a well-designed browser, screened at ingest, prompted defensively, and still walked out the front door with valid permissions.

Credential isolation belongs in the same stack, with its scope stated honestly. Holding dummy keys in the agent’s reach does not stop the agent being talked into something. It shrinks what a successful attempt can carry out. That is how ARMO approaches runtime security for AI workloads: one behavioral signal feeding discovery, posture, detection and enforcement, so an incident arrives as one explainable story rather than as scattered alerts from four consoles. Teams running this in production report the same effect on volume that ARMO customers saw on vulnerability work, where runtime reachability cut more than 90% of the CVE queue by removing findings that could never execute.

Run the Ledger Against Your Own Agents

The table earlier in this article works as a worksheet. Take the five controls and answer the third column for yourself.

Which of your agents has ever been threat-modeled, and does that model name the tools it can reach today rather than the ones it had at launch? Where does your boundary between instructions and retrieved data actually sit, and has anyone tried to break it? What injection placements has your screening layer never seen? Which agent actions in your environment require a human, and which ones can move data without one? What is your screening layer’s recall, and if you cannot answer that, what are you assuming it is?

The fourth question produces the uncomfortable answer, because most teams find the gated list is short and the ungated list is everything else. It gets harder still when the agent’s work spans providers, since each provider’s console sees only its own slice of the sequence.

Comet had a complete checklist and a published defense, and the attacks that landed still ran on permitted actions in an unfamiliar order. Screening what enters the agent is worth doing. Knowing what your agent normally does is what catches the rest. If you want to see the fifth column filled in for your own environment, book a session with ARMO and bring one agent you already run in production. Thirty minutes on a live cluster shows you which of its actions are gated, which are not, and what its behavior looks like once there is a baseline to compare against.

FAQ

Is Comet safe to use now? Perplexity has published four defense layers and a measured detection result, which is more transparency than any comparable vendor has offered. Its own published figures also show a residual at a 1% false positive rate and a further drop against injection placements the detector has not seen. For personal browsing that is a reasonable trade. For an account you would not want drained, keep the agent out of tabs holding data that matters.

What did Perplexity actually change after the first public disclosure? The published architecture describes classifiers running over retrieved content before it influences reasoning, structured prompting that marks external content as untrusted, human confirmation on four enumerated action classes, and user notifications when something is blocked. The benchmark paper adds declarative trust flagging on tools that can return untrusted content, and replacement of a blocked tool result with a placeholder so the agent can change course rather than retry.

Do prompt injection classifiers work? They work well enough to be worth running and not well enough to be the only control. The best published result on a realistic browser-agent benchmark reports 0.841 recall at a 1% false positive rate, and accuracy degrades against payloads rewritten into visible page text, against unfamiliar placements, and against phrasing that avoids trigger vocabulary. Treat the classifier as a filter that reduces volume rather than a gate that closes the path.

Which agent actions should require human confirmation? Enumerating actions does not scale, because every list of gated actions is also a list of ungated ones, and the documented exfiltrations all used the ungated side. A more durable approach gates on deviation from the agent’s own established behavior, so a familiar action performed in an unfamiliar sequence or toward an unfamiliar destination gets caught without a human approving routine work.

How do I test whether my own agent has this gap? Take one production agent and write down every action it can take, then mark which ones require a human. Then place a harmless marker string in a document the agent retrieves and check whether that string ever reaches an outbound request. If it does and nothing in your stack raises a signal, your coverage stops at the content layer, and the fix is telemetry on what the agent did rather than more screening on what it read.