Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers

Cybersecuritynews •Cybernewswire • November 19, 2025

Share: View original

Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.

© - Cyber Security News

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MCP API in Comet Browser Enables Full Device Control via Extensions SquareX has revealed a hidden MCP API in the Comet AI browser that allows extensions to execute arbitrary commands on users' devices. This API bypasses security measures found in traditional browsers, posing risks to user data and device integrity. The discovery raises significant security concerns for users of AI-powered browsers. 8 sources 36

Extracted Entities

Platforms (1)