Your iPhone Browser Just Became an AI Agent
Comet isn’t a browser upgrade, it’s a permission grenade. Here’s how to use it without blowing your hands off.
You think you’re installing the new Perplexity Comet browser on your iPhone.
You’re actually installing an assistant that can act.
That distinction is about to matter a lot more than you think.
The Overlooked Problem
Everyone’s still playing the traditional browser defense:
“Don’t click sketchy links.”
“Use an ad blocker.”
“Watch for phishing.”
That’s like locking your front door… while handing a stranger a copy of your keys because they said they’d help you clean the house.
Agentic browsers flip the risk model.
It’s no longer:
“Is this page malicious?”
It’s:
“What can my browser do after it reads this page?”
Because Comet isn’t just loading websites.
It’s interpreting them. Acting on them. Automating across them.
And honestly? That’s kind of unfair how much more powerful (and dangerous) that is.
The Shift You Need to See
Perplexity isn’t hiding the pitch.
Comet is a personal assistant inside your browser: with AI search, cross-site context, and automation baked in.
Translation:
Your browser just went from viewer → operator.
That’s like upgrading from a calculator to a junior employee who sometimes hallucinates confidence.
And if you make it your default browser on iPhone?
Every link from Messages, Slack, Notes, email, now routes through that employee.
No onboarding.
No supervision.
Just vibes and prayers
The Hidden Risk Layer
Traditional browsers are passive. They wait.
Agentic browsers don’t wait, they interpret intent.
This applies to all AI browsers, not just Comet: ChatGPT Atlas, Microsoft Copilot, Brave Browser, Claude Chrome Extension, etc.
That creates a new class of attack that most people aren’t ready for:
Old Model
Malicious page tricks you
New Model
Malicious page tricks your assistant
Assistant acts using your permissions
That’s like convincing your assistant to “just grab a file real quick”… and suddenly they’re emailing your tax folder to a stranger.
No exploit needed.
No malware.
Just bad instructions wrapped in normal-looking content.
What’s prompt injection?
I dive deeper into prompt injection and how to avoid it in a previous article I wrote:
The Part That Should Make You Pause
Recent security research around Comet and similar agentic browsers shows exactly where this breaks:
Prompt injection attacks can hide instructions inside webpages
The AI interprets those instructions as legitimate tasks
The browser then acts using your access (tabs, sessions, data)
Think of it like:
scraping HTML like an overprivileged intern digging through raw page data… except now that intern has your login cookies
Even better:
Some disclosures described zero-click scenarios: no obvious “click here” moment required.
Just… context → interpretation → action.
That’s the new kill chain.
Prompt Sanitizer & Jailbreak Academy
I built a simple prompt sanitizer to catch malicious or hidden instructions before they ever hit your model.
Drop in any prompt, and it scans for injection patterns, risky behaviors, and anything trying to override intent.
Try the prompt sanitizer + jailbreak academy here
Think of it as a pre-flight check for AI inputs—because what your model reads matters more than what you think you sent.
What You Can Actually Do
You don’t need to avoid Comet.
You just need to box it in like it owes you money.
Don’t make it your default (yet)
Treat it like a sandbox, not your operating system.
Your call. But I know which one actually scales.
Incognito Mode (in AI browsers) isn’t what you think it is.
It still prevents your local history from being saved, but it doesn’t stop websites, networks, or the AI itself from interpreting and acting on what it sees.
In an agentic browser like Comet, “private” doesn’t mean passive, the assistant can still read pages, follow instructions, and make decisions using your session.
Incognito hides traces from your device, not the behavior of your AI.
Disable the AI assistants on sensitive sites
Banking. Password managers. Admin dashboards. Anything with consequences.
If the browser can act, limit where it’s allowed to think.
Add friction to autofill
Auto-fill without confirmation + agent behavior = chaos.
Set things to “ask every time.”
Yes, it’s annoying.
That’s the point.
Use it for low-risk tasks first
Research
Summaries
Shopping (without checkout)
Not:
Payments
Account changes
Social media posting
Anything legal or financial
Watch what it actually touches
Turn on App Privacy Report in iOS
You want receipts.
Not assumptions.
Also check what permissions are enabled for the Comet browser:
The Real Pattern Everyone Misses
This isn’t about Comet.
It’s about what happens when:
untrusted content + AI interpretation + user permissions = action
That equation is new. It applies to all AI browsers: ChatGPT Atlas, Microsoft Copilot, Brave Browser, Claude Chrome Extension, etc.
And it breaks a lot of old assumptions.
Because now every webpage is two things:
Content for you
Instructions for your agent
And sometimes… those instructions are hostile.
The Bottom Line
Comet or any AI browser isn’t dangerous because it’s broken.
It’s dangerous because it works.
Too well…
You’re not browsing anymore.
You’re delegating tasks.
And delegation without boundaries?
That’s how you wake up to a system that did exactly what you asked…
Just not what you meant.
If you’re building with AI or letting it act on your behalf: you need to understand this shift early.
That’s what we’re doing inside The Secure Circuit
Because the people who figure this out now?
They’re going to have a very unfair advantage later.