By Dana Ellison
Publication Date: 2026-10-27 07:12:00
Analysis
Perplexity’s fix for a zero-click file-theft path was a hard boundary; Zenity walked around it twice — with a prefix and a fragment suffix. Two and a half months into browser-agent deployments, that is the question every enterprise should be asking about its vendor’s changelog.
The fix Perplexity shipped for its Comet browser was meant to be final: a hard boundary on file:// paths, out of reach of the agent no matter what the prompt said. Zenity Labs titled the account of what happened next Breaking the Patch, and the title is the finding. Blocking a disclosed path is not the same as closing the vulnerability. After Perplexity shipped a hard boundary blocking agent access to file:// paths, Zenity Labs bypassed it twice: first through view-source:file:// URLs, then by appending a #.pdf or #.html suffix that slipped past the filter.
What the boundary was holding back is worth stating plainly. A weaponized calendar invite reaches the agent; hidden instructions redirect it to an attacker-controlled page with zero clicks; the agent reads local files and moves them out as an ordinary page load, then abuses the unlocked 1Password extension to take over the vault — all while the task the user asked for appears to finish normally. Both exploit paths stem from what the field calls indirect prompt injection — untrusted content treated as instructions — and Zenity’s own summary of the patch cycle is the cleanest statement of the problem: “Each fix closed the exact…
