Unseeable prompt injection in screenshots: Vulnerabilities in Comet, AI browsers (brave.com)

Researchers Artem Chaikin and Shivan Kaul Sahib disclosed new prompt‑injection vulnerabilities across agentic AI browsers, extending prior findings about Perplexity’s Comet. In Comet, attackers can embed nearly‑invisible instructions into web pages (e.g., faint colored text on a matching background) that get captured when a user takes a screenshot; OCR or text extraction treats that hidden text as part of the user input and forwards it to the LLM, which may then execute malicious browser tools. In Fellou, simply asking the assistant to navigate to a site causes the browser to send the site’s visible content to the LLM as trusted context, letting page text override user intent. The authors responsibly disclosed the issues (discovery and reporting dates in 2025) and are holding back one additional finding for follow‑up. These incidents underscore a systemic problem for agentic browsers: failing to separate trusted user prompts from untrusted webpage content creates a new attack surface that circumvents traditional web protections (e.g., same‑origin assumptions) and can let agents act with the user’s authenticated privileges. For the AI/ML community this highlights the need for engineering controls around input provenance, strict isolation of agentic actions, explicit user invocation, and sanitization pipelines that treat OCR/extracted text as untrusted. Until categorical, cross‑browser safeguards exist, agentic browsing remains inherently risky for sensitive accounts and operations.