Comet Browser Flaw Lets Hidden API Run Commands on Users’ Devices

Back Hackread

Comet Browser Flaw Lets Hidden API Run Commands on Users’ Devices

Hackread •Deeba Ahmed • November 20, 2025

Share: View original

SquareX warns Perplexity's Comet AI browser contains a hidden MCP API that bypasses security, allowing attackers to install malware and seize full device control.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MCP API in Comet Browser Enables Full Device Control via Extensions SquareX has revealed a hidden MCP API in the Comet AI browser that allows extensions to execute arbitrary commands on users' devices. This API bypasses security measures found in traditional browsers, posing risks to user data and device integrity. The discovery raises significant security concerns for users of AI-powered browsers. 8 sources 36

Extracted Entities

Attack Types (1)

Companies (2)

Perplexity SquareX

Platforms (1)

Comet AI Browser

Vulnerabilities (2)

Comet Browser Flaw MCP API