Comet AI browser can get prompt injected from any site, drain your bank account

I doubt Comet was using any protections beyond some tuned instructions, but one thing I learned at USENIX Security a couple weeks ago is that nobody has any idea how to deal with prompt injection in a multi-turn/agentic setting.

Maybe treat prompts like it was SQL strings, they need to be sanitized and preferably never exposed to external dynamic user input

Sanitizing free-form inputs in a natural language is a logistical nightmare, so it's likely there isn't any safe way to do that.

Maybe an LLM should do it.

1st run: check and sanitize

2nd run: give to agent with privileges to do stuff