Comet AI browser can get prompt injected from any site, drain your bank account

Nobody could have predicted this /s

Joke aside, it's been pretty obvious since the beginning that security was an afterthought for most "AI" companies, with even MCP adding secure features after the initial release.

How does this compare to the way security was implemented by early websites, internet protocols, or telecom systems?

Must we learn the same lessons over and over again? Why? Is our industry particularly stupid? Or just lazy?

Financially motivated to not prioritize security.

It's hard to sell what your product specifically can't do, while your competitors are spending their time building out what they can do. Beloved products can make a whole lot of serious mistakes before the public will actually turn on them.

"Our bridges don't collapse" is a selling point for an engineering firm, on something that their products don't do.

We need to stop calling ourselves engineers when we act like garage tinkerers.

Or, we need to actually regulate software that can have devastating failure modes such as "emptying your bank account" so that companies selling software to the public (directly or indirectly) cannot externalize the costs of their software architecture decisions.

Simply prohibiting disclaimer of liability in commercial software licenses might be enough.

Call yourself whatever you choose, but the garage tinkerers will always move faster and discover new markets before the Very Serious Engineers have completed the third review of the comprehensive threat model with all stakeholders.