Brave Discovers New Prompt Injection Vulnerabilities in AI-Powered Browsers

Building on their previous disclosure of the Perplexity Comet vulnerability, Brave has continued its security research into agentic browsers. The findings confirm that indirect prompt injection is a systemic challenge across AI-powered browsers, not an isolated issue. This article examines additional attack vectors identified and tested by Brave’s researchers.

Why it Matters

AI-powered browsers are designed to perform actions on behalf of users, making them powerful tools. However, these capabilities come with significant risks. If a user is signed into sensitive accounts such as banking or email within the browser, an attacker could exploit prompt injection vulnerabilities to steal money or private data. Simply summarizing a Reddit post could lead to severe security breaches.

Key Risks

Brave's research has uncovered several new attack vectors:

Prompt Injection via Screenshots in Perplexity Comet

Perplexity’s Comet assistant allows users to take screenshots on websites and ask questions about those images. This feature can be exploited to inject prompts that bypass traditional text-based input sanitization. Malicious instructions embedded as nearly invisible text within the image are processed as commands rather than untrusted content.

How the Attack Works:

• Setup: An attacker embeds malicious instructions in web content, making them hard for humans to see. In Brave's test, they hid prompt injection instructions using faint light blue text on a yellow background.
• Execution: When a user takes a screenshot and asks Comet a question about it, the assistant processes the hidden commands as valid input.

The Opportunity

Brave has responsibly reported these issues to various companies to ensure vulnerabilities are addressed. They emphasize that a safer web benefits everyone and encourage ongoing debate and research into secure agentic AI. The company's commitment to transparency is evident in their detailed disclosures and responsible disclosure practices.

Responsible Disclosure

• Perplexity Comet: Brave disclosed the vulnerability and provided details on how it can be exploited.
• Opera Neon: Details of a prompt injection flaw were released after Opera requested more time to address the issue. The full report is now available.

Conclusion

The discovery of these new vulnerabilities underscores the need for continued vigilance in the development and use of AI-powered browsers. While these tools offer significant benefits, they also introduce complex security challenges that require ongoing research and collaboration among industry stakeholders. Brave's proactive approach to identifying and disclosing such vulnerabilities sets a positive example for ensuring the safety and privacy of users.