AI Browser Security Risks: How Calendar Invites Can Access Local Files
A recent security flaw in Perplexity’s AI-powered Comet browser has highlighted the risks associated with AI browser agents. The vulnerability could have allowed attackers to access files on a user’s computer using something as routine as a calendar invitation.
Understanding the Risk
AI browser agents can read data, follow instructions, and act on behalf of users. However, security experts warn that these tools may introduce new attack paths if guardrails are not carefully designed. The incident with Perplexity’s Comet browser is a prime example of this risk.
Researchers from Zenity Labs disclosed the vulnerability, which affects agentic browsers, including Perplexity’s Comet. The AI-powered browser can interpret instructions, retain authenticated context, and autonomously execute actions across applications and services.
Calendar Invites as Attack Vectors
Attackers could exploit the vulnerability by hiding harmful content within everyday tasks, such as calendar invitations. The AI agent could access the file:// protocol, allowing it to retrieve files stored on the user’s local device.
For example, a malicious calendar entry could contain a prompt instructing the AI tool to scour through the victim’s files, look for documents named ‘passwords’ or similar, and exfiltrate whatever information is found.
Patch Released
Perplexity released an initial patch in January 2026, but researchers later found they could bypass the fix using a modified file path technique. A second patch released in February restricted the browser’s ability to access the local file system through the file:// protocol, closing the attack path demonstrated by the researchers.
In conclusion, the incident highlights the complexity of securing AI-powered tools that automatically process large amounts of external content and perform tasks on behalf of users. Therefore, it is essential to be aware of these risks and take necessary precautions to ensure the security of your organization’s IT defenses.
