Is Perplexity Comet safe? What its assistant sees, and five prompt injection reports

The Morse teamPublished October 30, 20269 min read

As of October 2026, Perplexity's Comet browser is reasonably safe as a browser, but its built-in assistant is only as safe as the least trustworthy page you ask it to read while you're signed in to your email, calendar, or password manager. Comet keeps your history, cookies, and saved passwords on your device, and its assistant sends page content to Perplexity only when a request needs it. Four security teams have published five prompt injection attacks on Comet since August 2025, and Perplexity itself calls prompt injection "an unsolved problem across the industry."

We read Perplexity's privacy notice (last updated October 19, 2026), the Comet terms, a dozen articles in the Comet help center, Perplexity's two security posts about Comet, and each researcher's own write-up on October 23, 2026. Every fact below links to the page it came from. For Perplexity's search app, its training switch, and its retention periods, see our guide to whether Perplexity is private; this page covers the browser.

Comet's safety settings at a glance

What can Comet's assistant see?

The page in front of you, when you ask. Perplexity says the assistant "pulls in the visible text, headlines, and website metadata from your open page every time you submit a request," and can read any other tab you name with @ (Perplexity).

By default it doesn't read your browsing history, your full list of tabs, cookies, saved passwords, local files, or what you type into websites, according to Perplexity's assistant privacy page. When a request does need page content, history items, or open tabs, Comet sends "only the minimal required context," and Perplexity keeps it "for up to 30 days" to power your Library. Those threads show up as Temporary threads, where you can delete them or remove the timer.

The assistant can also act. Comet's terms say "by using Comet you permit a virtual agent to act on your behalf" on other sites and services, and that anything between you and those services is "solely between you and such third party provider." The same terms, last updated July 8, 2025, say of the software: "YOU BEAR THE RISK OF USING IT."

Can Comet get into your logged-in accounts?

Yes, when you let it, and that's where the published attacks aim. Perplexity says Comet "will always ask for approval first" before it uses another service like Gmail, and that it "never has access to your passwords or payment data" (Perplexity). Comet doesn't need your passwords to reach an account you're already signed in to, though. Your cookies and signed-in sessions stay in the browser the agent works in (Perplexity).

In March 2026, a Zenity Labs researcher sent a calendar invite with hidden instructions, and when the user asked Comet to handle the meeting, the agent opened the user's unlocked 1Password web vault, read a stored login, and sent it to an attacker's address. In a second version, it changed the 1Password account's password and sent out the account's Secret Key (Zenity Labs). Zenity called it "a zero-click attack" because "a single calendar invitation is sufficient."

Perplexity's line about passwords refers to Comet's own password manager. The 1Password vault in Zenity's demo was a website the user was already signed in to, which the agent could open like any other tab.

Has Comet been hacked through prompt injection?

Researchers have shown it can be, five times in public. Prompt injection means hiding instructions in content the assistant reads, so it treats a stranger's text as your request.

Brave's first report described the root cause in one line: Comet fed part of the page to its model "without distinguishing between the user's instructions and untrusted content from the webpage" (Brave).

Zenity's write-up lists what Perplexity changed on February 13, 2026: better detection for that attack, stricter confirmation before sensitive actions, and a setting to keep the agent off chosen sites. Zenity adds that the site blocking isn't on by default, so you configure each site yourself, and sums up the defaults this way: "The mitigations are opt-in. The risk is opt-out" (Zenity Labs).

How does Perplexity protect Comet from prompt injection?

With layers, and with a plain admission that none of them is complete. Perplexity's October 22, 2025 post describes four: classifiers that scan retrieved content before the assistant acts, prompts that mark outside content as untrusted, a confirmation step, and a notice when something is blocked. Comet pauses before it sends an email or message, changes your calendar, places a final order, or fills in details about you it doesn't already have, and Perplexity says it does so "regardless of whether our systems detect suspicious activity." The post doesn't mention Brave or LayerX.

Perplexity deserves credit for what it published next. On December 2, 2025, it released BrowseSafe, a detection model and a benchmark of 14,719 examples, both fully open source, with a model you can run locally (Perplexity). Its own results show that attacks hidden in comments are caught relatively well, while those in visible footers, table cells, or ordinary paragraphs are harder to catch, and multilingual attacks harder still.

Do Perplexity's own pages agree about Comet?

Not everywhere. We found four places where two Perplexity pages, both live on October 23, 2026, say different things.

• Passwords. The privacy notice says that if you save "passwords, payment data, account information, or other content" to Comet, "we process that data" (Perplexity). The help center says "Comet never uploads or shares your saved passwords" (Perplexity).
• Password sync. The same help article says passwords are "stored only on your current device." The sync article lists passwords among the things Comet syncs (Perplexity).
• Browsing history. The sync article says your synced data is encrypted with "a private passphrase only you control," and "only your passphrase can decrypt your data." The privacy notice says that, depending on your settings, "we record your browsing history and track your use and engagement when you use Comet with your synced Perplexity account."
• Phones. The Comet home page says it's "available for Mac, Windows, iOS, and Android" (Perplexity). A help article last edited on September 14, 2026 says "there is currently no publicly available mobile app for iOS or Android" (Perplexity), while another explains how to install Comet for Android from the Play Store (Perplexity).

The privacy notice is the dated legal document, so where it says more than the help center, plan on the notice.

Is Comet's incognito mode private?

From other people on your computer, yes. From Perplexity, not for AI requests. Perplexity's local data page says that if you use the assistant in Incognito, "your query and the context needed to answer it are still sent to Perplexity's servers." Perplexity doesn't save those requests to your history when AI Data Retention is off, but "security logs and abuse-detection signals continue to exist regardless of Incognito." The privacy notice adds that in incognito, "we, and third parties like the websites that you visit, may still be able to track you" (Perplexity).

How to make Comet safer

Each of these settings is on Perplexity's own pages, and each one shrinks what a malicious page can reach.

1. Block the assistant on sensitive sites. Go to Settings, then Privacy and security, then Comet Assistant, and add your bank, your email, and your password manager's web vault. Perplexity gives the bank as its own example (Perplexity).
2. Choose "Allow this time only." When an agent runs for the first time, Comet offers "Always allow," which suppresses future prompts (Perplexity). Answering one run at a time keeps a person in the loop.
3. Don't let the agent read untrusted content while you're signed in. Every attack in the table started with text a stranger wrote: a comment, a link, an image, or a calendar invite.
4. Lock your password manager. Zenity found 1Password's extension stays unlocked for up to eight hours by default, and that its new "Ask before filling" control is opt-in (Zenity Labs).
5. Block third-party cookies. They're allowed by default for compatibility. Change it under Settings, Privacy and security, Third-party cookies (Perplexity).
6. Turn the assistant off when you don't need it. The same Comet Assistant setting can disable it entirely.

How Morse keeps what you read off company servers

Every attack above relies on an assistant that reads a stranger's text while it holds your signed-in sessions, and the context it reads lands on Perplexity's servers for up to 30 days. Morse is a web app for chat, not a browser, so you decide what goes into each message, and your chat history stays in your own browser, encrypted, not on our servers.

Morse doesn't train AI on your content, sell your data, or show ads. Our servers don't keep messages or log what you write, so no copy of the page you asked about waits on our servers for 30 days. Three modes cover the jobs people hand to Comet's assistant:

• E2EE, for summarizing an email or invite that should stay between you and the model. Before anything is sent, your browser verifies the secure enclave's proof that it's genuine, then seals the message so only that enclave can read it. Morse's servers pass along ciphertext they can't open. E2EE runs open-weight models and has no web search, and its guarantee depends on the enclave hardware and attestation working as designed. Our explainer on end-to-end encrypted AI chat walks through each check.
• Private, the default, for research questions that need the web. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, answer here. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. See what zero data retention means for the details.
• Anonymous, for GPT, Claude, or Gemini with your name taken off. Morse's proxy strips your account, email, and IP address and sends the request under Morse's own account, so the provider reads the text without knowing it's you. It may keep that text for a limited time to check for abuse, under its own policy, so trim personal details from anything you paste.

Your history locks when you sign out and takes two keys to open, one of which never leaves your device. Clearing your browser deletes your chats for good, and Morse can't recover them, so save anything you'll need. If you're weighing other search tools, our Perplexity alternatives compares them, and our guide to using AI privately covers the rest.

Paste the next page you'd have handed to Comet into a chat from the Morse home page, no account needed, or start free. E2EE chats come with Pro, at $19 a month.