Researchers at Zenity Labs discovered flaws affecting multiple AI browsers, including Perplexity’s Comet. Before being patched, an attacker could exploit them via a legitimate calendar invite, using a prompt injection to force the AI browser to act against its user. (Image via Getty)
Through a simple calendar invite, AI browsers like Comet can be directed to access local file systems, browse directories, open and read files, and exfiltrate data.
Europol, the European Union’s law enforcement agency, is pictured at its headquarters building on June 24, 2020 in The Hague, Netherlands. (Photo by Yuriko Nakao/Getty Images)
Chairman Sen. Bill Cassidy (R-LA), is one of four Senators to sponsor the Health Care Cybersecurity and Resiliency Act, which passed through the Senate HELP Committee 22-1. (Photo by Andrew Harnik/Getty Images)
The global campaign marks the second series of multiple actively exploited zero-day vulnerabilities in Cisco edge technology since last spring. The similarities don’t end there.
Too many defenders and researchers are paying attention to defects and unsubstantiated exploit concepts that aren’t worth their time, VulnCheck’s Caitlin Condon said.