Perplexity Comet

Comet is safe enough as a plain web browser, but its headline feature, an AI assistant that clicks, types and shops for you, has a weak security record. In five published studies, four research teams have shown that text hidden in a web page, email, screenshot or calendar invite can take over the agent. We score Comet 53/100, below Perplexity's own app (59) and well below Brave (80).

Is Perplexity Comet safe?

Underneath, Comet is Chromium, the same engine as Google Chrome, with Google Safe Browsing switched on. If you never open the assistant, your exposure is close to any other Chromium browser.

The assistant changes that. It can read every tab, see your logged-in Gmail or calendar, and act on your behalf. A normal browser treats a web page as something to show you. Comet's agent treats it as something to read and follow, and that is where the trouble starts.

Perplexity runs a private bug bounty on Bugcrowd, a public vulnerability disclosure policy, annual penetration tests and a SOC 2 Type 2 audit, according to its security page. We found no breach of Comet user data.

The prompt-injection record

Prompt injection means hiding instructions in content an AI reads so that it obeys the attacker instead of you. Comet has been a favourite target:

Perplexity patched the Zenity flaws and the first Brave finding, though Brave says that fix is incomplete. The pattern still matters: each fix closed one route, and the next team found another. OpenAI warned about the same risk when it launched its own agent browser, ChatGPT Atlas, in October 2025, and has since retired Atlas.

What Comet collects

The labels look reassuring. Apple's lists no tracking and nothing linked to you, though it does list browsing history, location, contact info and financial info collected for analytics, personalisation and app features. Google Play's form says the Android app collects web browsing history and in-app search history, and shares device IDs and crash data with other companies.

Perplexity's privacy notice, last updated in July 2026, goes further. It says that, depending on your settings, Perplexity records your browsing history and tracks your use of Comet when the browser is synced to your Perplexity account. Its California disclosure table lists internet activity, which can include browsing and search history, as shared with advertising partners for targeted advertising. It also says Perplexity does not sell personal data or send your prompts to advertisers. When a policy is broader than the store label, we score the policy.

Intent matters too. In April 2025 Perplexity's chief executive, Aravind Srinivas, told the TBPN podcast that one reason to build a browser was to "get data even outside the app to better understand you", for better-targeted ads, as TechCrunch reported. Comet's settings give you some protection: a third-party cookie block, incognito windows and an "AI data retention" switch that stops your searches being used for training. That switch starts on.

Who should be careful

People who stay logged in to email, banking and shopping sites carry the most risk, because those sessions are exactly what a hijacked agent can use. Comet's agent will also fill in saved addresses and card numbers, which is useful on a real shop and costly on a fake one.

1. Keep the assistant away from your inbox, bank and password manager. If you use the 1Password extension, lock it before asking the agent to do anything.
2. Do not ask the agent to act on links or invites from people you do not know.
3. Watch the agent when it shops or fills in forms, and check the domain before it pays.
4. Turn off "AI data retention" in your Perplexity account settings.
5. Do not sync Comet to your Perplexity account if you do not want your browsing history on its servers.

How we scored it

The regulatory record (86) is Comet's best factor: no regulator has fined or ordered Perplexity over the browser, and Amazon's suit over Comet shopping on its site is a dispute between companies. Privacy (45) and security (45) are the weakest. Privacy falls because the policy allows synced browsing history and sharing with ad partners, despite a clean App Store label. Security falls because the agent has been hijacked again and again, even though no breach of user data has been reported. If you want a Chromium browser without an agent reading your pages, Brave carries far less of this risk.