A newly identified “zero-click” attack demonstrates how Perplexity’s Comet browser—an agentic, automation-driven interface—can be manipulated into deleting a user’s entire Google Drive. By embedding natural-language instructions inside an email, threat actors can weaponize the browser’s high-privilege automations to perform destructive actions without requiring user confirmation.

Agentic browsers and LLM-powered assistants increasingly automate routine tasks across Gmail, Google Drive, and other cloud services. These systems operate with elevated OAuth permissions and chain actions together through natural language. While convenient, this creates a new security model: actions become implicit, contextual, and interpreter-driven rather than strictly user-initiated.

Researchers at Straiker STAR Labs found that Perplexity’s Comet browser could be tricked into reading an attacker-supplied email, interpreting embedded instructions as part of a typical “organization task,” and executing them automatically. These instructions instructed the browser to clean up Google Drive, delete files, and verify completion. No explicit malicious indicators were required; polite language was enough to trigger compliance.

Comet integrates deeply with Gmail and Google Drive via OAuth, granting it permissions to:

When a user issues a benign prompt such as “Please take care of my recent email tasks,” the agent scans the inbox, discovers the attacker’s crafted message, and executes instructions inside it.

Key technical factors:

This transforms trivial emails into operational instructions for a high-privilege cloud automation tool.

If triggered, the agent can:

Because the execution flow appears legitimate, the user may not realize what happened until after substantial data has been wiped.

This attack surfaces a new class of risk:
LLM-driven, agentic automation systems can be manipulated through benign-looking natural language content.

Traditional security controls—sandboxing, phishing detection, and permission prompts—are bypassed because the agent executes actions on behalf of the user, using its privileged connectors.

Researcher Amanda Rousseau notes that the danger comes not from bypassing restrictions, but from the agent’s willingness to interpret courtesy and structure as operational intent. The vulnerability highlights the need to secure:

Rather than focusing solely on LLM hardening.