AEDAnswer Engine Daily
← All stories

Perplexity Says Comet Flagged 1.15 Million Prompt Injections on Web Pages in a Year. It Does Not Say Which Sites Carried Them, or How Many Targeted Brands

Sandeep Amar · November 3, 2026 · 5 min read
Perplexity Says Comet Flagged 1.15 Million Prompt Injections on Web Pages in a Year. It Does Not Say Which Sites Carried Them, or How Many Targeted Brands
LLMs · Answer Engine Daily

Perplexity, the AI search company that also makes the Comet browser, says Comet’s prompt injection detector flagged 1.15 million injections on pages its agent read between September 2025 and September 2026. The figure comes from a research post, dated October 28 in its citation block. More than 23,000 injections in BrowseSafe++, the 38,675-pair benchmark Perplexity built mostly from those detections, arrived through content anyone can post, such as a forum post or a shared document, according to the post.

The post does not name the sites, does not say how many pages Comet read in that year, and does not say how many injections tried to change what an AI says about a brand or product. The 1.15 million are flags from Comet’s detector. Before building the benchmark, Perplexity removed duplicates and had a panel of models confirm each page, and it built 32,187 pairs from the result. The post does not say how many flags were duplicates or false alarms. Perplexity’s own conclusion: “no detection model is a silver bullet.”

What is an indirect prompt injection?

Perplexity defines it as an attacker placing malicious text on a webpage that a browsing agent then reads. “If the agent follows these instructions, it can return a misleading answer or take an action the user didn’t request,” the post says. A product description is page content; a line telling the agent to buy something or abandon the user’s task is an injection.

When Perplexity released the first BrowseSafe benchmark in December 2025, it used synthetic attacks. Real attacks often no longer use giveaway phrases like “ignore previous instructions,” the company says, and often mimic “an official notice from the site or a note about user preferences.”

What did Perplexity find in the wild?

The post describes these patterns across the flagged injections:

  • Fake authority: One example poses as the agent’s developer. Others, Perplexity says, can pose as the site itself (security checks, policy notices) or the user (fake preferences).
  • Language switches: In 24.4% of page pairs, the injection is in a different language from the page, typically English on a non-English page.
  • Actions over answers: More than four in ten push the agent toward an action the user never asked for, and about a third try to make it drop the task. Only about 3% try to plant false information in the answer.
  • Open content: “A trusted domain can still be utilized for injecting an attacker’s text,” Perplexity wrote.

This means answer manipulation is a small slice of what Perplexity caught, and the 3% is not broken down by brand, product or category.

Does detection fix it?

Not on its own, by Perplexity’s own numbers. Perplexity trained two small detectors, BrowseSafe-Guard, on part of the benchmark. On its own tests, Guard reaches an F1 of about 95% (a score that rewards catching attacks without false alarms) and costs an estimated $0.18 per 1,000 pages, against $18.95 to $180.61 for frontier API models at list prices. These are self-reported numbers, on Perplexity’s benchmark, for a detector trained on part of it.

Two findings in the same post cut against detection as the fix. Models still followed injections they had flagged: Claude Sonnet 5 on 19.74% of pages, ten times GPT-5.5’s 1.97%, though their detection F1 scores were about 88% and 89%. And when an attacker model could rewrite failed injections, success rose from at most 4% on the first attempt to at least 79% of tasks against five of seven agents, with up to 64 attempts per task. With Guard screening pages for one agent, attackers still won 84.2% of tasks, against 93.6% without it.

Why does this matter for AEO?

My read is that most SEOs file prompt injection under security team, not my problem. This data puts it on the surfaces AEO depends on. In The AEO Process, which I laid out in my post on Google’s AI guide, Reddit and forums are the third surface. The open posting that makes them citable is the route Perplexity describes.

Agents read pages in four views, according to Perplexity: HTML, Markdown, accessibility trees (a structured list of a page’s interface elements and their labels) and screenshots. Perplexity checked that each benchmark injection showed up in all four, so check yours in more than the rendered page. Look at your forums, comments and shared documents in those views, and moderate for the patterns above, plus chat markers like <|im_start|>, which Perplexity found in a forged conversation on a code repository page.

This is my personal view. If you are tempted to plant agent-addressed text that steers answers toward your brand, don’t. Perplexity’s guardrails post says it updates Comet’s classifiers with attack techniques found through real-world detections. My read is that you would be handing Perplexity material for its next classifier update.

What the post does not say

Questions only Perplexity can answer:

  • Brand targeting: How many of the 1.15 million injections targeted answers about brands or products?
  • Sites: Which sites carried them? The post rewrote real names and brands as fictional ones.
  • Search exposure: Were Perplexity’s search answers exposed? Its guardrails post describes classifiers that screen pages for Comet, but for search it describes only retrieval and citations. Its safety post covers the defenses in Comet and its Computer agent.
  • Denominator: How many pages did Comet read in that year? Without that, 1.15 million has no rate.

Sources

More in LLMs