Researchers at Guardio, Trail of Bits, and Zenity Labs demonstrated that Perplexity’s Comet AI browser can be manipulated into autonomously executing phishing attacks, credential theft, and 1Password vault takeovers, in some cases completing the full attack chain in under four minutes. The core vulnerability is not a single patchable flaw: it is a structural property of current agentic AI architectures, where verbose reasoning output becomes an adversarial feedback channel and prompt injection via untrusted web content requires no user interaction. Organizations deploying AI browsers or any agentic tooling with access to credential stores should treat this as an active, generalizable threat class, not a vendor-specific incident.