Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers

Gbhackers •CyberNewswire • November 19, 2025

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MCP API in Comet Browser Enables Full Device Control via Extensions SquareX has revealed a hidden MCP API in the Comet AI browser that allows extensions to execute arbitrary commands on users' devices. This API bypasses security measures found in traditional browsers, posing risks to user data and device integrity. The discovery raises significant security concerns for users of AI-powered browsers. 8 sources 36

Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers

The full story

Extracted Entities

Attack Types (2)

Platforms (1)