LayerX documents that an unrecognized collection parameter caused the assistant to read stored connector content (email/calendar/contacts) rather than perform a live web search, enabling exfiltration with a single click.
For practitioners: Observe patterns to monitor and mitigate, strict parsing and whitelisting of URL/query-driven instructions, provenance metadata for memory reads, output sanitization that blocks connector secrets from being copied, and defense-in-depth for connector scopes.
Industry teams building or integrating AI browsers and agentic assistants should treat connector data and memory as high-risk I/O and instrument exfiltration detection (for example, outgoing POSTs containing encoded connector data).
What to watch (reported/open): LayerX has published PoCs and disclosure timelines; vendors' public responses vary by product and are still evolving.
Observers should watch for vendor advisories, published patches, and independent reproduction results from third-party auditors.
LayerX's write-ups separate two related vectors. The first is the BioShocking prompt-injection pattern: a webpage injects hidden prompts and memory entries that reframe logic (for example, asserting false axioms) so the assistant treats subsequent malicious instructions as valid game objectives, then copies a "hidden code" that is actually sensitive data. The second, described in LayerX's "CometJacking" post, demonstrates a URL-query attack against Perplexity's Comet where specially crafted query parameters force the agent to read from its memory/collections, encode results (for example, base64), and POST them to an attacker-controlled endpoint. LayerX documents that an unrecognized collection parameter caused the assistant to read stored connector content (email/calendar/contacts) rather than perform a live web search, enabling exfiltration with a single click.
Editorial analysis: These are distinct but complementary failure modes: (1) contextual reframing undermining intent filters, and (2) agent flows that accept remote parameters and prioritize memory/connector reads. Both exploit the same core reliance on context and the lack of robust provenance or semantic integrity checks on inputs (URL parameters, page-injected prompts, and memory entries).
For practitioners: Observe patterns to monitor and mitigate, strict parsing and whitelisting of URL/query-driven instructions, provenance metadata for memory reads, output sanitization that blocks connector secrets from being copied, and defense-in-depth for connector scopes. Industry teams building or integrating AI browsers and agentic assistants should treat connector data and memory as high-risk I/O and instrument exfiltration detection (for example, outgoing POSTs containing encoded connector data).
What to watch (reported/open): LayerX has published PoCs and disclosure timelines; vendors' public responses vary by product and are still evolving. Observers should watch for vendor advisories, published patches, and independent reproduction results from third-party auditors.
