Zero-Click Attack on Perplexity’s Comet Browser

AI browsers are designed to make our work easier – but when that same automation turns into a threat, the damage can be unimaginable. Recently, cybersecurity researchers discovered a zero-click exploit in Perplexity’s Comet browser that can completely delete your Google Drive with just a single email.

This technique has been named: Google Drive Wiper, and its severity is such that the user doesn’t need to click anything – the browser acts automatically.

How does this attack work?

The Comet browser provides automated access to tools like Gmail and Google Drive. This means the user can give instructions in simple language, such as: “Handle this file.” “Take care of it.” But this very feature opens the door for cyber attackers. The LLM sometimes interprets such vague sentences as action commands and can delete or move files without confirmation.

So the hacker simply does this:

Sends emails containing malicious prompts,

The browser executes the instructions as soon as it reads the email,

Drive data can be deleted or modified,

The user remains unaware – until the data is gone.

Another Threat: Hashjack Attack. This technique works even more stealthily.

HashJack is a prompt injection attack in which the hacker inserts hidden commands inside a URL, after # (hash). This URL looks normal, but the part after the (#) may be a hidden prompt. AI-powered browsers (like Comet) read this hidden text as a prompt and can initiate actions accordingly.

What does Hashjack do?

The hacker creates a URL containing hidden AI commands. As soon as the user opens the link, the prompt is injected into the browser. The AI ​​agent can execute file operations and Drive actions. The attack can be launched by sending the link anywhere – email, WhatsApp, X (Twitter), Facebook, etc. This is also a zero-click style client-side exploit. The user opens the link → The attack is executed.

Why is the threat significant for organizations?

Business documents, client files, research data, everything is stored on Drive. Zero-click exploits are difficult to detect. Due to the unpredictability of LLM, even a small prompt change can have a big impact. Attack automation can take down multiple accounts at once. AI browsers make things faster – but this same automation, if unchecked, can be disastrous.

How can you keep yourself safe?

Security experts recommend a four-layer protection approach:

• Don’t just secure the model – secure the entire system. Make sure the agent, browser permissions, and connector are all secure.
• Prevent AI from taking harmful actions based on unclear language. Vague commands like “handle this” and “do this” should be blocked.
• Permission prompts should be required for sensitive apps, and drive actions should require explicit confirmation.
• Verify URLs and email links before opening them. The easiest way to avoid hidden phishing attacks is awareness.

AI browsers are the future – faster, hands-free, and smarter. But with automation comes the biggest questions:

Who has control? With the user or with the AI ​​agent?

The Comet Browser zero-click exploit is a reminder that AI is as powerful as it is risky. The next cyberwar will be fought not with a keyboard, but with prompts.