Perplexity's Comet presents enterprise security teams with the most honest version of the AI-browser dilemma, because both halves of it are unusually well documented. On one side: the most real enterprise deployment story of any agentic browser — silent MDM installers for macOS and Windows, 500+ Chromium policies, an answer-only mode, telemetry with scheduled exports, a CrowdStrike Falcon integration, SOC 2 Type II. On the other: the deepest verified attack record of any AI browser, ending — so far — with a zero-click compromise class demonstrated at Black Hat this month that reached local files and a password manager, and that the researchers say bypassed Perplexity's patches twice.
Hold both truths at once and the decision framework follows. That's this post: the evidence, then the call.
Last verified: August 20, 2026.
What Comet is now — and why the stakes rose in May
Comet went from Max-subscriber novelty (July 2025) to all Enterprise Pro seats (late August 2025) to a managed enterprise offering (March 2026). The threshold moment for security teams came around May 2026, when Perplexity's "Computer" shipped native add-ins for Word, Excel, PowerPoint, and Outlook: the agent can now edit spreadsheets and financial models directly, rewrite documents, and compose email using thread history and attachments, reaching SharePoint and 400+ connectors from the sidebar. That is write access to the estate where your numbers and your correspondence live. An injected instruction is no longer a wrong answer — it's a modified model or a sent email. And note the governance consequence: the choke point moves partly out of the browser entirely, into Microsoft 365 add-in management.
Credit where due
Perplexity has built more admin surface than any AI-browser rival: MDM deployment with org-level gating for pilots; the full Chromium policy set; agent restriction modes (answer-only, or actions limited to approved domains); domain blocking and approval requirements; Comet Telemetry with downloadable reports and webhook/SFTP scheduling; audit logs on larger tiers; contractual no-training terms extending to model subproviders; and the opt-in CrowdStrike runtime layer. Judged as enterprise software plumbing, this is a serious offering — which is exactly why the decision is genuinely hard rather than trivially "no."
The attack record, in order
| When | What was shown |
|---|---|
| Aug 2025 | Brave: Comet's page summarizer executed hidden instructions embedded in web content — indirect prompt injection, called systemic to the category |
| Aug 2025 | Guardio's "Scamlexity": the agent bought from a fake shop and walked a phishing flow, prompting the user for credentials; a March 2026 follow-up tricked it into phishing in under four minutes |
| Oct 2025 | Brave again: near-invisible instructions in images executed via OCR |
| Oct 2025 | LayerX's CometJacking: a one-click crafted URL turned Comet's authorized Gmail/Calendar connectors into an exfiltration channel. Perplexity's response — classifying it as "no security risk" — belongs in your vendor-risk file |
| Jun–Jul 2026 | University of Washington study: in several agentic browsers, Comet included, the same-origin policy — a thirty-year-old browser guarantee your security model assumes — effectively degrades to the strength of the agent's prompt-injection defenses |
| Aug 5, 2026 | Black Hat: the zero-click "Intent Collision" class — one poisoned calendar invite hijacked Comet into local-file exfiltration and a password-manager account takeover via agent-authorized workflows. Per the researchers, their chains bypassed Perplexity's patches twice |
The through-line: every control Perplexity added governs what the agent may do; every attack subverts what the agent decides to do. Policy restrictions and injection resistance are different problems, and the record shows the second one unsolved — for the whole category, with Comet as its best-documented case.
The legal backdrop just shifted too
Amazon sued Perplexity in November 2025, alleging Comet disguised its automated sessions as ordinary Chrome traffic to transact on customer accounts, and won an injunction in March. On August 4, 2026, the Ninth Circuit vacated it — reasoning that because Comet acts at the user's direction, it is the user accessing the site, not Perplexity. Two enterprise implications: your SaaS vendors can no longer assume courts will keep agents out (their terms and your policies have to do that work), and agent actions are legally your users' actions — which makes governing them your problem, precisely. Amazon's revised seller agreement now requires AI agents to identify themselves; expect that clause to spread.
Sanction, restrict, or block — the framework
Gartner's standing advice (December 2025) is blunt: block agentic AI browsers for now, and if you proceed anyway, do it with strict risk analysis, tight allowlists, and continuous monitoring. The evidence above supports a three-tier version:
- Block by default — the analyst-aligned baseline. MDM app-blocking plus SWG domain controls; treat unmanaged Comet installs as shadow AI and let discovery find them (they will exist — the browser is free).
- Restrict for a pilot cohort, if the business case is real. The configuration that makes this defensible: MDM-deployed and org-gated; answer-only mode or approved-domains-only agent actions; connectors off (especially mail and calendar — the demonstrated attack paths); no password-manager extension in Comet; "Computer" M365 add-ins disabled at the Microsoft admin level; telemetry exported to the SIEM; CrowdStrike layer on; and a written expiry date on the pilot.
- Sanction broadly only when the zero-click class is demonstrably closed — meaning independent researchers, not vendor patch notes, stop finding one-invite compromises. Until then, broad deployment is a bet against the entire published record.
Whichever tier you choose, choose it explicitly and in writing. The worst posture is the default one — where Comet arrives on personal initiative, with connectors authorized, and your first notice is telemetry you never configured. (Finding those installs, and what the agent inside them touched, is discovery-layer work — the endpoint problem, wearing a browser icon.)
FAQ
Can our proxy or CASB govern Comet?
It can see the flows — Comet is Chromium talking TLS to Perplexity endpoints — but flows aren't intent: network tools can't distinguish the user's click from an injected agent action. That's why the meaningful controls are the agent-mode restrictions, connector governance, and endpoint-level visibility, not URL filtering.
Isn't this every AI browser's problem, not just Comet's?
Yes — the zero-click class hit five major agentic browsers, and the UW findings generalize. Comet earns the dedicated post because it's the one shipping to enterprise seats with M365 write access and an MDM story; the framework here applies to Atlas-successor features in ChatGPT, Gemini-in-Chrome, and whatever ships next quarter.
Perplexity says enterprise data isn't trained on and providers can't retain it. Does that settle privacy?
It addresses model-training exposure, which is one risk of five. Injection, connector exfiltration, output manipulation, and the write-access blast radius are unaffected by training commitments. Contract terms and runtime security are different layers; evaluate both. (Treat compliance claims like HIPAA support as marketing language until a BAA is actually on the table.)
What would change the verdict?
Two things: an independent demonstration that the injection class no longer yields zero-click compromise, and action-level audit logs exposed to customers by default rather than tier-gated. Vendor roadmaps that head there are worth rewarding with pilots — under the restrict configuration above.
Sources: Perplexity — Comet Enterprise and enterprise help center · Perplexity — Computer in Word, Excel, PowerPoint, Outlook · CrowdStrike partnership · Brave research (Aug 2025) and screenshot injection (Oct 2025) · LayerX — CometJacking · Guardio follow-up · University of Washington study · Black Hat zero-click research (Aug 2026) · Ninth Circuit vacatur (Aug 4, 2026) · Gartner — block AI browsers for now (Dec 2025).
Related: Perplexity Data Security · Gemini Enterprise: The Security Review · ChatGPT Work: The Security Review · Introducing Endpoint AI Governance.