|
Issue 21
|
|
The weekly brief A calendar invite was enough to turn an AI browser against its own user. Researchers just showed the same trick works browser after browser.This issue walks through exactly how the exploit works, why a single patch can’t close it, and what it means if your next job is reading output from an agent that already has your login. October 12, 2026 · 10 min read
|
Sourced from Zenity Labs, CyberScoop, Dark Reading, The Register, Akto, HackerOne. | No hype We cover disclosed, patched vulnerabilities — not speculative fear. | Why now Researchers just demonstrated zero-click hijacks across major AI browsers. |
|
If you read nothing else A booby-trapped calendar invite was enough to make an AI browser read local files and expose a connected password vault — no click required. Researchers then showed the same flaw category hijacks five of the biggest AI browsers, with no clean, universal patch. Enterprises are racing ahead anyway: one recent report found only 21% of security teams have real visibility into what their AI agents actually do. The tools built to act on your behalf are reading everything you can read, and now, so can an attacker. |
|
|
Nova’s signal “This isn’t a Perplexity problem. It’s an architecture problem — any agent that inherits your login and reads untrusted text has the same hole, patched or not.” Nova’s call. Before you let an agent browse, book, or read on your behalf, ask exactly what it can see that a stranger never could. Last issue we watched the AI agent get its own computer and a seat at the table. This one is the bill for that autonomy. Story 01 has the calendar invite that hijacked an AI browser; 02 widens it to the exploit researchers ran across the industry; 03 is Google’s own calendar flaw in Gemini; 04 is the enterprise visibility gap; 05 is a security firm told its finding carried no risk.
|
|
This week 5 developments that show what “agentic” actually costs.
|
|
01 / Security A calendar invite just proved what an AI browser can read.Security firm Zenity Labs disclosed a flaw it calls “PerplexedBrowser” in Perplexity’s Comet browser: a calendar invite seeded with hidden instructions could direct Comet’s built-in agent to browse local directories, open files, and send the contents to a third-party server, with no click from the user beyond accepting the meeting. Cyberpress reported the flaw was rated critical on Bugcrowd, and that the exposure reached data in a connected 1Password vault. Perplexity’s first attempted fix, shipped January 23, 2026, could still be bypassed; a more complete patch followed on February 13. Why it matters. Comet’s agent doesn’t cleanly separate “content to summarize” from “instructions to follow” — the same ambiguity sits underneath every agent that reads your inbox, calendar, or files on your behalf. Patching one browser’s version of this doesn’t patch the pattern. The signal. Zenity says it privately reported the flaw to Perplexity on October 22, 2025 — nearly four months before a fix that actually held. Zenity Labs: the PerplexedBrowser disclosure →
|
|
02 / Security The Comet bug was the preview. Here’s the whole category.At Black Hat USA 2026, Zenity Labs demonstrated a broader exploit class it calls “PleaseFix,” built around a technique it names “Intent Collision”: hidden instructions planted in an email, a calendar invite, or an ordinary web page can override what a user actually asked an agent to do, without any click. Dark Reading’s coverage says the demonstrations reached Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge. Vendor responses split: some shipped quick fixes, others reportedly treated the behavior as working as designed, and the Cloud Security Alliance’s research note argues no single patch closes the whole class. Why it matters. If the root cause is architectural rather than a bug in any one product, “which AI browser is safest” is the wrong question for now — the better one is what each vendor actually lets you turn off. The signal. The CSA traces the common failure to agentic browsers inheriting a user’s logged-in session while processing untrusted page content with no boundary between the two. Dark Reading: AI browsers vulnerable to ‘PleaseFix’ →
|
|
03 / Security Google had its own version — in the calendar, not the browser.Separately, researchers at Miggo Security found that Gemini could be manipulated through a hidden instruction embedded in a Google Calendar event description, written by someone other than the invite’s recipient. Gemini ingested that description as if it were a legitimate system instruction, which could expose private meeting details to whoever sent the invite. Per Malwarebytes, Google confirmed the finding and mitigated it in January 2026, weeks before the Comet disclosures became public. Why it matters. This isn’t a scrappy-startup problem. The same category of flaw reached one of the most resourced security teams in the industry, which means “use the big, trusted vendor” isn’t itself a security strategy here. The signal. Google’s relatively fast turnaround — mitigated within the same reporting cycle — is one of the few clean counterexamples to Perplexity’s two-attempt patch. Malwarebytes: malicious calendar invites could expose private data →
|
|
04 / Enterprise AI Enterprises are buying agents faster than they can watch them.Akto’s inaugural State of Agentic AI Security report, published December 8, 2025 from responses by hundreds of CISOs and security leaders, found 69% of enterprises are already piloting or running AI agents in production, while only 21% have a complete, up-to-date inventory of what those agents and their connected tools can actually access, and 79% lack a governance policy for agent permissions. A CrewAI-sponsored survey of 500 senior executives, published in February, reported that every respondent’s company planned to expand agentic AI use in 2026 — worth reading as a vendor’s own customer base, not a market-wide figure. Why it matters. The gap between “we deployed it” and “we can see what it did” is exactly the gap the Comet and PleaseFix exploits lived in. Building and documenting that visibility, by hand if the tooling isn’t there yet, is becoming a hireable skill on its own. The signal. A Dark Reading reader poll closing out 2025 found roughly 48% named agentic AI and autonomous systems the top attack vector heading into 2026 — a readership poll, not a scientific sample, but a consistent signal across multiple write-ups. Akto: State of Agentic AI Security 2025 →
|
|
05 / Trust One researcher called it a privacy disaster. Perplexity called it no risk.Brave’s research team separately tested Comet by hiding instructions invisible to a human reader inside a Reddit post; when Comet’s agent summarized the page, it executed those hidden commands as if they were the user’s own, per ppc.land’s reporting. LayerX separately disclosed a related flaw it named “CometJacking,” in which a single crafted URL with the right query parameters could pull email, calendar, and connected-account data out of the browser. Perplexity’s initial public response to these reports was that it saw “no security impact” and marked them not applicable, before later disabling the exposed MCP API without much public explanation. Why it matters. When independent researchers and a vendor disagree this sharply about severity, the gap gets absorbed by whoever is actually using the tool — right now, that’s early adopters, not enterprise security teams. The signal. The disagreement is also a hiring signal: outside researchers are finding and triaging these bugs faster than some vendors acknowledge them — exactly the labor the next section is about. ppc.land: Comet’s prompt-injection vulnerabilities →
|
|
Signal & chatter A few more things worth knowing.AI red-teaming has a staffing shape now. HackerOne’s own playbook for running AI red-teaming engagements recommends teams of 15 to 25 testers over 15- to 60-day runs for agentic products — a shape companies are starting to budget before launch, not after a breach. Explore → | Hackers are already using AI to find bugs like these. Bugcrowd’s January 2026 survey found 82% of hackers now use AI in their own workflow, up from 64% in 2023 — plausibly including the exact kind of prompt-injection chains in this issue. Explore → |
|
|
From the community Reported experience · Privacy Guides and Choice community forums. A direct Reddit thread on this specific disclosure didn’t surface this week, so this is where security-conscious readers actually dissected it. One Privacy Guides commenter called the Comet disclosures “a privacy disaster” and said flatly, “don’t use their browser.” A Choice community thread was more split: one reader said anyone who values privacy “even to the slightest degree” should be alarmed, another argued it’s tame next to sites that already track every purchase, and a third noted that any AI browser advertising “enterprise-grade security” is using the same kind of language “military-grade encryption” claims once did. See the Privacy Guides thread →
|
|
FOWL prediction 21 By June 30, 2027, at least one major agentic browser vendor will sell a locked-down “enterprise mode” that blocks the agent from acting on untrusted calendar invites, emails, or third-party pages without a separate, logged approval step — as a paid compliance tier, not a universal security patch.Procurement teams, not individual users, are the ones asking Akto’s visibility question, and 2026 vendors have already shown they’ll ship review and governance features as separately priced tiers rather than free fixes (see last issue’s prediction on review tooling). The PleaseFix research itself argues the underlying flaw can’t be patched away for good, which pushes vendors toward selling a safer mode instead of promising a universal fix. The honest counter-case: a regulator or a high-profile breach could force a free, mandatory fix before any vendor gets to charge for safety. Review date: June 30, 2027.
|
|
Put it to work 3 things to do this week.| 01 | If you or your team already use an agentic browser — Comet, Atlas, Copilot Edge, Gemini in Chrome, Claude in Chrome — check what it’s allowed to read without asking you first, and whether that default is one you actually chose. | | 02 | Audit what’s connected to it: password manager, calendar, email, cloud drive. Disconnect anything you wouldn’t want read by whoever sends the next bad calendar invite. | | 03 | If agent security looks like a career lane worth exploring, start with the public write-ups — Zenity’s and HackerOne’s own breakdowns of these exact exploits are a free, current syllabus. |
|
Career radar AI Red Team Security EngineerThis is the role this week’s story effectively created: someone who tries to break agents — prompt injection, tool misuse, data exfiltration — before an attacker does. Jobgether has an AI Red Team Security Engineer listing; Institute Data lists a remote AI Security Analyst role at $111/hr; and OpenTrain.ai is hiring an AI Red Teaming and Prompt Injection Security Expert. Titles and pay vary a lot by poster — treat the ranges as directional, not a market median. A place to start. Learn the OWASP LLM Top 10 and run an open testing framework like Garak or PyRIT against a model you already have access to, then write up what you find. You don’t need a security background to start. Explore AI careers → |
|
|
The opportunity board Know where to look.HackerOne now runs structured AI red-teaming engagements built for agentic products specifically, not just chatbots — recommending teams of 15 to 25 testers over 15- to 60-day runs. HackerOne’s AI Red Teaming playbook → Bug-bounty platforms are already paying for exactly these findings: Bugcrowd rated the Comet calendar-invite bug P1/critical, and its January 2026 hacker survey found 82% of hackers now use AI themselves to find flaws like it faster than some vendors patch them. FOWL’s own AI jobs board tracks openings like these as they post. Bugcrowd: Inside the Mind of a Hacker 2026 →
|
|
An agent that can read your calendar can read anything a calendar invite tells it to. That’s not a flaw in one browser’s code — it’s the deal every agentic tool makes with you the moment it starts acting instead of just answering. Until next Monday,
TYB
Data scientist & founder, FOWL AI
|
|
One question for you Would you trust an AI browser with your calendar today?Hit reply. I read every response, and it helps shape what we cover next.
|
|
Online · Vibe Code Saturdays Read about the future.
Then build it.A free, hands-on Saturday to build a website, newsletter, portfolio, or useful tool with AI. Beginners welcome. Live on Zoom. Saturday, October 24 · 11am to 2pm ET. Apply and we’ll email your Zoom link and setup videos.
|
Know someone who’d find this useful?Share this briefing → Forwarded this email? Get the free weekly briefing.
|
|
|
|