Topic starter
02/08/2026 12:14 pm
TL;DR: A single crafted email can steer Perplexity Comet into deleting Google Drive content with no click, no phishing link, and no extra confirmation, according to Straikerai’s STAR Labs, exposing a zero-click agentic browser attack path across Gmail and Drive. The real control problem is connector governance, because natural-language task instructions can still trigger destructive actions.
Editorial analysis by NHI Mgmt Group, based on content published by Straikerai: “From Inbox to Wipeout: Perplexity Comet’s AI Browser Quietly Erasing Google Drive”.
Key questions
Q: Where do agentic browser controls fail in practice?
A: They fail when the agent is allowed to treat content as instruction and the connector has the power to act on that instruction without a separate approval boundary.
Q: Why do browser agents turn email into a destructive risk?
A: Because they collapse reading and acting into the same workflow.
Q: What are the signs that an agentic browser is being manipulated?
A: Warning signs include unexpected downloads, unplanned navigation, unusual code copy actions, and task completion that does not match the user's intent.
Practitioner guidance
- Constrain destructive connector actions Block mass-delete, empty-trash, and bulk-rename actions unless the agent receives explicit confirmation for that exact operation and target scope.
- Classify instruction sources as untrusted Treat instructions embedded in email bodies, documents, and shared notes as untrusted inputs and require an additional validation step before execution.
- Shrink delegated Google Drive scope Separate read-only retrieval from write and delete permissions so the browser agent cannot escalate from inbox triage into destructive Drive actions.
Bottom line: Agentic browsers can turn ordinary email into an execution path, which makes inbox content part of the attack surface when connectors are over-privileged.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:16 pm
Agentic browsers create a new delegated-identity risk surface: the assistant is not just parsing content, it is exercising user-authorised action across connected systems. That makes inbox messages, shared documents, and task notes part of the control plane when the agent is allowed to act on them. Identity and access teams should treat browser agents as non-human identities with constrained authority, not as harmless productivity helpers.
A question worth separating out:
Q: Should teams compare prompt filtering with connector governance?
A: Connector governance matters more when the goal is preventing damage. Prompt filtering can reduce obvious abuse, but it will not stop a well-phrased instruction from becoming a permitted action if the agent already has write or delete access. Teams should treat prompt filtering as a front-line screen and connector controls as the real enforcement layer.
👉 Read our full editorial: Zero-click browser agents can turn email into Google Drive wipeouts