Disclosure: I work on LLM security for Google.
This is really an amateur-level attack even after all this VC money and 'top engineers' not even thinking about basic LLM security for an "AI" company makes me question whether if their abilities are inflated / exaggerated or both.
Maybe Perplexity 'vibe coded' the features in their browser with no standard procedure for security compliance or testing.
Shameful.
The browser is the ultimate “lethal trifecta”: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Giving an LLM’s agentic loop access to the page is just as dangerous as executing user controlled JavaScript (e.g. a script tag in a reddit post).