Perplexity’s AI-powered browser Comet has gained significant attention since its launch. It blends standard browsing with agentic capabilities that can read pages, perform tasks, orchestrate workflows, and interact with local resources in ways that conventional browsers typically restrict. A recent report by cybersecurity company SquareX has highlighted an undocumented system-level interface that deserves attention—not because it poses an immediate threat to everyday users, but because it challenges long-standing assumptions about how browsers should interact with the underlying operating system.
Hidden Extensions
Comet ships with two bundled extensions that do not appear in chrome://extensions or any standard extension management dashboard, meaning users cannot disable or uninstall them. This practice is not unusual; Chrome and other browsers also ship with embedded extensions that implement core functionality.
In Comet’s case, the hidden Analytics extension and the Agentic extension provide the browser’s AI-driven capabilities.
Extension Stomping
Extension stomping is a technique where an attacker replaces a legitimate browser extension with a malicious one by spoofing its identity. Browsers identify extensions using a unique extension ID derived from the extension’s cryptographic key. If an attacker can obtain or replicate that key, they can create an impostor extension that the browser treats as genuine. After sideloading it, usually through enabling the extension developer mode and with local device access, the malicious extension inherits all the privileges and permissions of the original.
In Comet’s case, this means a forged extension can impersonate the hidden Analytics extension, inject scripts into perplexity.ai pages, and trigger privileged internal components.
This is not a trivial attack. It requires the attacker to already have access to the machine and to enable developer mode in order to sideload the spoofed extension. These conditions rule out remote drive-by attacks and place the scenario firmly in the category of post-compromise escalation. Still, it demonstrates how control over a single key can collapse the security boundary between a trusted embedded extension and an untrusted impersonator.
The Hidden MCP API
SquareX also discovered that Comet implements an undocumented MCP API (chrome.perplexity.mcp.addStdioServer), which allows the Agentic extension to execute arbitrary commands on the host machine. Traditional browsers confine such capabilities behind explicit user consent and tightly controlled native messaging systems. Comet takes a different approach by exposing this functionality directly to its embedded extensions.
For most Comet users, the likelihood of someone gaining local access, enabling developer mode, and sideloading a forged extension is low. Without those steps, the embedded extensions cannot be replaced, and the MCP API cannot be invoked by an attacker. Even so, SquareX’s demonstration highlights structural design choices rather than active exploitation risk.
Check out SquareX’s detailed report on their blog.