Comet AI browser can get prompt injected from any site, drain your bank account

I doubt Comet was using any protections beyond some tuned instructions, but one thing I learned at USENIX Security a couple weeks ago is that nobody has any idea how to deal with prompt injection in a multi-turn/agentic setting.

Maybe treat prompts like it was SQL strings, they need to be sanitized and preferably never exposed to external dynamic user input