Obscure MCP API in Comet Browser Breaches User Trust, Enabling Full Device Control via AI Browsers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MCP API in Comet Browser Enables Full Device Control via Extensions SquareX has revealed a hidden MCP API in the Comet AI browser that allows extensions to execute arbitrary commands on users' devices. This API bypasses security measures found in traditional browsers, posing risks to user data and device integrity. The discovery raises significant security concerns for users of AI-powered browsers. 8 sources 36