←back to thread

Comet AI browser can get prompt injected from any site, drain your bank account

(twitter.com)
645 points helloplanets | 1 comments | 24 Aug 25 15:14 UTC | HN request time: 0s | source
Show context
nromiun ◴[24 Aug 25 19:03 UTC] No.45006748[source]▶
After all the decades of making every network layer secure one by one (even DNS now) people are literally giving a plaintext API to all their secrets and passwords.

Also, there was so much outrage over Microsoft taking screenshots but nothing over this?

replies(4): >>45006813 #>>45007058 #>>45008118 #>>45011908 #
compootr ◴[24 Aug 25 19:11 UTC] No.45006813[source]▶
at least this is opt-in (you must download the browser)

Microsoft's idea was to create the perfect database of screenshots for stealer log software to grab on every windows machine (opt-out originally afaik)

replies(3): >>45007204 #>>45007766 #>>45008331 #
1. moritzwarhier ◴[24 Aug 25 21:03 UTC] No.45007766[source]▶
Well I think at least a double-digit percentage of people could be persuaded to enter their e-mail credentials into a ChatGPT or Gemini interface – maybe even a more untrusted one –under the pretense of helping with some business idea or drafting a reply to an e-mail.