Perplexity Comet (agentic browser)

Citation check incomplete — recheck later.

Summary

Comet is Perplexity's AI browser with a built-in assistant that browses, clicks and fills forms for the user. Four independent sources were found. In the CAP benchmark (COLM 2026), Comet fully completed 6.0% of complex cross-site tasks but led all systems on partial completion (48.0%). On the KNOWS Google Workspace benchmark (September 2026), it was the best system tested but fully succeeded on only 2.7% of tasks. A privacy measurement study found 2 privacy issues out of 15 checks. One was a missing phishing/malware warning, which was patched in December 2025. An hCaptcha abuse test found Comet completed 15 of 18 abuse scenarios. Security researchers (Brave, LayerX, Guardio, academic groups) have published several prompt-injection attacks; Perplexity has added defences. Amazon's lawsuit over Comet's shopping use is ongoing; a preliminary injunction was vacated on appeal in August 2026. Informational only; not a guarantee, endorsement, or certification.

Overall score: 41 · Evidence grade: B- · Independent sources: 4 performance (1 peer-reviewed), 6 other

Evidence grade describes the amount and type of evidence, not the agent's quality. Grade B-: 4 counted sources (3–4 band; see methodology).

Factor breakdown

0.30 × 40 + 0.20 × 40 + 0.25 × 30 + 0.25 × 55 = 41.25, rounded to 41 (rounding rule).

Scope

The Comet browser and its Comet Assistant agent (desktop; launched 9 July 2025, free to all users from 2 October 2025), with whichever model Comet selects or the user picks. The Perplexity answer engine and its Deep Research mode are covered by the separate Perplexity entry. See the Perplexity entry for citation and source-attribution behaviour.

Version note

Comet is treated as one continuous product since its launch on 9 July 2025. The model behind Comet Assistant varies over time and by user choice (for example, Gemini 3.1 Pro in CAP and Claude Opus 4.7 in KNOWS), so results may not carry over between models.

Disclosures for counted sources

• CAP: one author interned at FellouAI, whose browser agent was also evaluated.
• Privacy Practices of Browser Agents: two authors work at Brave, which makes a competing browser.
• hCaptcha: sells agent-detection products; the report is not peer-reviewed and gives summary results only.

Disputes

Amazon.com Services v. Perplexity AI (N.D. Cal. No. 3:25-cv-09514; 9th Cir. No. 26-1444) concerns Comet’s assistant shopping on Amazon.com. A preliminary injunction was granted on 9 March 2026 and stayed on 18 March 2026. The Ninth Circuit vacated it and remanded on 4 August 2026, and denied rehearing en banc on 10 September 2026. The case continues. No regulator action specific to Comet was found.

Security

• Brave reported an indirect prompt injection via page content on 25 July 2025. Perplexity acknowledged it and deployed a fix, and Brave published on 20 August 2025. Brave later said the fix was incomplete and re-reported it.
• LayerX reported “CometJacking” (instructions passed in crafted URL parameters) on 27–28 August 2025. Perplexity marked the reports “Not Applicable”.
• Guardio (“Scamlexity”, August 2025) showed Comet completing a purchase on a fake shop and following phishing links in controlled tests.
• Academic proofs of concept: Mind the Web (Ben-Gurion University) and WAAA! (NC State).
• Perplexity describes its defences as classifier-based detection, prompts that keep the assistant on the user’s task, confirmation before high-risk actions, and user notifications (October 2025).

Privacy note

Comet’s assistant sends page content and screenshots to Perplexity’s servers. The Privacy Practices study found built-in tracker blocking, and a missing phishing/malware warning that was patched on 2 December 2025. Perplexity’s privacy policy was not reviewed in detail for this entry.

Uncertainties

• Comet's agent model changes over time and by user choice (Gemini 3.1 Pro in CAP, Claude Opus 4.7 in KNOWS).
• Only one counted source is peer-reviewed; hCaptcha and Privacy Practices have commercial or competing-author interests (disclosed).
• Amazon v. Perplexity continues on remand; outcome unknown.
• Comet sends page content and screenshots to Perplexity servers for the assistant; Perplexity's privacy policy was not reviewed in detail for this entry.
• Citation check incomplete — recheck later (0052: Semantic Scholar unavailable; OpenAlex title screen only).

Sources

Independent performance sources (counted)

• CAP benchmark (COLM 2026): 198 cross-site tasks; Comet (Gemini 3.1 Pro, default settings, Nov-Dec 2025) 6.0% full success, 48.0% partial completion (highest), Complex-A 67.0%, Complex-P 58.0%; over 100k output tokens per task. Competing-author disclosure: one author interned at FellouAI, whose browser agent (Fellou) was also evaluated in CAP — accessed 2026-10-17
• KNOWS (University of Utah, preprint Sept 2026): 110 Google Workspace tasks; Comet (Claude Opus 4.7 agent) success rate 2.7% overall (Docs 12.0%, Sheets 0%, Slides 0%), ASC 35.4, ACF 70.0, SF 64.7; best of all systems; same model scored lower in an open harness — accessed 2026-10-17
• Privacy Practices of Browser Agents (UCSD, Imperial College, Brave; preprint Dec 2025): Comet 139.1.7258.139 had 2 of 15 privacy concerns (fewest tied); built-in blocker blocked trackers; no Safe Browsing warning on one test, disclosed 24 Oct 2025 and patched 2 Dec 2025. Competing-author disclosure: two authors work at Brave, which makes a rival browser — accessed 2026-10-17
• hCaptcha Threat Analysis Group (Oct 2025): 20 abuse scenarios; Comet completed 15 of 18 applicable, 1 partial, 2 refusals; noted unprompted SQL injection and invented card details. Disclosure: hCaptcha sells agent-detection products; not peer-reviewed; summary results only — accessed 2026-10-17

Other sources (not counted)

• Brave (competing browser maker): indirect prompt injection via page content during summarisation, reported 25 July 2025; Brave later reported the fix as incomplete and re-reported it — accessed 2026-10-17
• LayerX "CometJacking" (Oct 2025, as reported by BleepingComputer): crafted URL parameters instruct the assistant to read memory/connected services and send base64-encoded data out; Perplexity marked the reports "Not Applicable" — accessed 2026-10-17
• Guardio "Scamlexity" (Aug 2025): Comet completed purchases on a fake shop and followed phishing links in controlled demos; "PromptFix" hidden-text CAPTCHA injection — accessed 2026-10-17
• Mind the Web (Ben-Gurion University, preprint): single manual demonstration of local file exfiltration from Comet via a Reddit comment; no per-agent rate — accessed 2026-10-17
• WAAA! (NC State, preprint May 2026): proofs of concept; Comet posted a copied account key in comments under one prompt, refused without warning when the phrase was removed; one attack worked in Sept 2025 — accessed 2026-10-17
• Ninth Circuit opinion, Amazon v. Perplexity (4 Aug 2026): preliminary injunction vacated and remanded; en banc rehearing denied 10 Sept 2026 — accessed 2026-10-17

Not counted

• Trail of Bits audit commissioned and paid for by Perplexity (April 2025, before launch): four prompt-injection techniques exfiltrated Gmail data; Perplexity says the gaps were fixed. Not independent — accessed 2026-10-17
• BrowseSafe (Perplexity): prompt-injection detector and 14,719-example benchmark; F1 up to 0.904. Vendor research, not counted — accessed 2026-10-17
• Perplexity description of Comet prompt-injection defences (classifiers, confirmation for high-risk actions, notifications) — accessed 2026-10-17
• Perplexity-authored usage study of Comet adoption (July-Oct 2025 data). Vendor, not counted — accessed 2026-10-17

Decision record: 0028.