Hidden API in Perplexity Comet Enables Device Hijacking

Security researchers have uncovered a hidden application programming interface in Perplexity's Comet AI browser that could allow attackers to execute arbitrary commands on users' devices, potentially leading to full hijacking of the underlying operating system.

The vulnerability, detailed in a report released this week by browser security firm SquareX, centers on a custom Model Context Protocol API embedded in Comet's Agentic extension. This API, named chrome.perplexity.mcp.addStdioServer, enables extensions to run local commands beyond the browser's sandboxed environment, a capability that mainstream browsers like Chrome, Safari and Firefox explicitly block through strict safeguards. SquareX researchers identified the API while examining Comet's embedded Analytics Extension, noting its lack of documentation and persistent access without user consent.

In a demonstration, the researchers spoofed a legitimate extension by altering its ID, sideloaded it into Comet, and injected a script via the perplexity.ai webpage. This triggered the Agentic extension to invoke the MCP API, resulting in the execution of WannaCry ransomware on the test device. Similar exploits could occur through...