Back Scworld

Novel attack technique places Comet AI browser in phishing trap | brief

Scworld • March 13, 2026

Agentic AI browsers, such as Perplexity's Comet, could be deceived into reducing their security defenses and be victimized in phishing scams through "Agentic Blabbering" exploitation, reports The Hacker News .

Inputting traffic between the browser and AI services on the vendor's servers, including information requested and decisions made by the browser, into a Generative Adversarial Network enabled the entrapment of the Comet browser in a phishing scam in less than four minutes, according to Guardio analysts, who noted the attack's similarity with the VibeScamming and Scamlexity methods.

"This reveals the unfortunate near future we are facing: scams will not just be launched and adjusted in the wild, they will be trained offline, against the exact model millions rely on, until they work flawlessly on first . Because when your AI Browser explains why it stopped, it teaches attackers how to bypass it," said Guardio.

Such findings come after Comet was coaxed by Trail of Bits to steal users' data across several services through four prompt injection techniques. Comet was also noted by Zenity Labs to be impacted by a pair of zero-click intrusions allowing local file exfiltration and 1Password account takeovers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Comet AI Browser Vulnerable to Phishing via Agentic Blabbering Exploit Perplexity's Comet AI browser has been compromised through a novel attack method called 'Agentic Blabbering', which exploits the browser's interaction with AI services. Analysts from Guardio reported that this phishing scam could ensnare users in under four minutes by manipulating traffic between the browser and vendor servers. The attack method is reminiscent of previous techniques like VibeScamming and Scamlexity. Additionally, Comet has been previously targeted by Trail of Bits, which demonstrated its susceptibility to data theft through prompt injection techniques. Zenity Labs also identified two zero-click vulnerabilities that could lead to local file exfiltration and 1Password account takeovers. The findings indicate a concerning trend where AI systems may be trained offline to bypass security measures effectively. This incident highlights the growing sophistication of phishing attacks targeting AI-driven technologies. 2 sources 65

Extracted Entities

Novel attack technique places Comet AI browser in phishing trap | brief

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)