←back to thread

Comet AI browser can get prompt injected from any site, drain your bank account

(twitter.com)
645 points helloplanets | 5 comments | 24 Aug 25 15:14 UTC | HN request time: 0.905s | source
Show context
theideaofcoffee ◴[24 Aug 25 15:32 UTC] No.45004998[source]▶
Beyond being a warning about AI, which is helpful, you really should be taking proper security precautions anyway. Personally, I have a separate browser that runs no extensions set aside that's solely dedicated to doing finance- and other PII-type things. It's set to start on private browsing mode, clear all cookies on quit and I use it only for that. There may be more things that I could do but that meets my threat threshold for now. I go through this for exactly the reason in the tweet.
replies(8): >>45005107 #>>45005112 #>>45005240 #>>45005242 #>>45005255 #>>45005338 #>>45005378 #>>45005931 #
1. scared_together ◴[24 Aug 25 15:59 UTC] No.45005255[source]▶
I thought that incognito mode in Chrome[0] and private mode in Firefox[1] already disables extensions by default.

[0] https://support.google.com/chrome_webstore/answer/2664769?hl...

[1] https://support.mozilla.org/en-US/kb/extensions-private-brow...

replies(2): >>45005300 #>>45051227 #
2. jraph ◴[24 Aug 25 16:04 UTC] No.45005300[source]▶
Absolutely, except for extensions you explicitly want to have in private mode, which is opt-in.
replies(1): >>45008669 #
3. chrisjj ◴[24 Aug 25 23:13 UTC] No.45008669[source]▶
So? Extensions are opt-in in regular mode too.
replies(1): >>45010535 #
4. jraph ◴[25 Aug 25 05:32 UTC] No.45010535{3}[source]▶
I'm agreeing with my parent comment, to which I'm adding some precision.
5. dolmen ◴[28 Aug 25 12:14 UTC] No.45051227[source]▶
private/incognito mode doesn't protect against XSS.