Do those countermeasures mean human-in-the-loop approving actions manually like users can do with Claude Code, for example?
It still suffers from the LLM forgetting that the string is the important part (and taking the page content as instructions anyway) but maybe they can drill the LLM hard in the training data to reinforce it.
Show me something that is obfuscated and works.
It's clear to a moderator who sees the comment, but the user asking for a summary could easily have not seen it.
Disclosure: I work on LLM security for Google.
This is really an amateur-level attack even after all this VC money and 'top engineers' not even thinking about basic LLM security for an "AI" company makes me question whether if their abilities are inflated / exaggerated or both.
Maybe Perplexity 'vibe coded' the features in their browser with no standard procedure for security compliance or testing.
Shameful.
The browser is the ultimate “lethal trifecta”: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Giving an LLM’s agentic loop access to the page is just as dangerous as executing user controlled JavaScript (e.g. a script tag in a reddit post).
It’s actually worse than that though. An LLM is like letting attacker controlled content on the page inject JavaScript back into the page.
I recently learned about https://xcancel.com/zack_overflow/status/1959308058200551721 but I think it's a nitter instance and thus subject to being overwhelmed
paool•5mo ago
nativeit•5mo ago
It's bulletproof.