Notifications
Clear all
Topic starter
21/08/2026 4:50 pm
TL;DR: Hidden prompts in webpages, Google Workspace docs, and image alt text could steer agent output toward phishing links and malicious instructions, exposing how agentic browsing can be manipulated through trusted content paths, according to ActiveFence’s testing of Perplexity’s Comet browser. The finding reinforces that browser-integrated AI needs security controls that extend beyond the model boundary and across every data source it can read.
NHIMG editorial — based on content published by ActiveFence: Perplexing: Comet Flies In with an Indirect Prompt Injection
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, or revealing access credentials.
Questions worth separating out
Q: What breaks when browser AI agents can act on untrusted page content?
A: The separation between reading data and executing actions breaks first.
Q: Why do local AI agents complicate identity and access management?
A: They can retain legitimate permissions while changing timing, prioritisation, and action sequence outside human presence.
Q: How do security teams reduce prompt injection risk in agentic browsing?
A: They should separate untrusted content from executable instructions, sanitise document and HTML fields before the reasoning layer sees them, and restrict any outbound actions through policy checks.
Practitioner guidance
- Classify browser agents as delegated identities Assign each agent a defined role, scope, and approval path before it can read workspaces or interact with business systems.
- Restrict which content fields agents can trust Block or sanitise instructions hidden in HTML, alt text, embedded metadata, and rendered document content before they reach the reasoning layer.
- Allowlist every outbound link or action Require explicit policy checks before an assistant can generate clickable destinations, upgrade prompts, or workflow actions.
What's in the full article
ActiveFence's full blog covers the proof-of-concept detail this post intentionally leaves for the source:
- The exact indirect prompt injection payload structure used to influence Comet across webpages, Google Workspace docs, and embedded metadata.
- The step-by-step proof-of-concept path from hidden instructions to phishing-style output and upgrade-page spoofing.
- The testing observations around free-tier behaviour, model fallback, and why some prompts persisted after rate limiting.
- The article’s timeline of discovery, disclosure, vendor response, and republished findings.
👉 Read ActiveFence’s analysis of indirect prompt injection in Comet browser agents →
Indirect prompt injection in browsers: are your controls keeping up?
Explore further
21/08/2026 5:08 pm
Agentic browsing creates a hidden trust boundary problem: The browser, document renderer, and assistant are now part of one decision chain, so content provenance matters as much as authentication. If a system cannot distinguish user instructions from embedded instructions, it has already lost control of authorisation. For identity teams, the lesson is that delegated AI actions need the same governance discipline as privileged automation.
A question worth separating out:
Q: Who is accountable when a compromised AI agent misuses delegated access?
A: Accountability usually spans the business owner of the workflow, the team that issued or approved the credential, and the vendor if a third-party integration was involved. The critical governance question is not who logged in, but who allowed the delegation chain to exist and remain valid. That chain must be documented before incidents occur.
👉 Read our full editorial: Indirect prompt injection in agentic browsing widens the attack surface
