Perplexity Comet: what an agentic browser does to your site, and the court case about it
Comet is free on every platform and its agent acts on sites for a real user. Amazon sued over exactly that, won an injunction, then lost it on appeal. The access question is now a live legal one.
Comet is the agentic browser that stuck. It arrived in July 2025 behind a $200-a-month plan, went free for everyone in October 2025, reached Android in November 2025 and iOS in March 2026. The browser and the assistant cost nothing; autonomous background agents need Pro or Max.
That matters more than the product details. ChatGPT Atlas — the other browser everyone wrote about — was discontinued in August 2026. Comet is free, on every platform, and in front of a lot of people. If you are seeing agentic sessions on your site, a good share of them are this.
What it looks like at your edge
A Comet session is a real Chromium engine on a consumer connection, usually one person doing one task. That produces a traffic shape worth recognising, because it is not the shape of a scraper:
| Agentic browser session | Scraper | |
|---|---|---|
| Volume | One task, one session | Thousands of sessions |
| Addresses | The user's own connection | Residential proxy pool |
| Target | A handful of pages toward a goal | Systematic enumeration |
| Assets fetched | Everything a browser fetches | HTML only |
| Who benefits | The person who asked | The operator |
Volume and distribution are usually the cleanest way to tell them apart, and both are properties of the aggregate rather than of any single request. See agentic browsers for the full argument, and note the practical consequence: a per-IP rate limit tuned to stop scrapers will not notice Comet at all, which is the correct outcome.
The security findings, and why your pages are the delivery surface
Comet has had a rough time from researchers, and the findings are about the browser rather than about your site. They are still worth knowing, because your pages are the delivery surface.
Brave's security team disclosed indirect prompt injection in August 2025: hidden page content — white text on white, HTML comments, nearly-invisible text in images — caused Comet to perform sensitive cross-site actions, including fetching one-time passwords from email, when the user merely asked it to summarise the page.
CometJacking, from LayerX, needed only a crafted URL. Instructions in a query-string parameter told the agent to read its memory and connected services instead of searching, and to exfiltrate the result as an encoded payload. Existing data-loss protections did not cover deliberately obfuscated output. Perplexity marked the reports not applicable.
The MCP surface was found vulnerable to a class of attack capable of granting full device control — see MCP security for why that category is structurally difficult.
The common root is architectural rather than a set of implementation bugs: the agent does not separate the user's instruction from the page's content. Both go into the model together, so a page that contains instructions is a page that can issue them. That is a design property, and it is why these findings keep recurring in different forms.
Amazon v. Perplexity, and why it should change your policy
Amazon went to court to stop Comet's shopping agent acting on its site. A district court granted a preliminary injunction on 9 March 2026. The Ninth Circuit vacated it on 4 August 2026.
So the agent is not restrained, and the substantive question is unresolved: may a retailer refuse an automated client that is acting for its own logged-in customer? Both answers have uncomfortable consequences, which is presumably why it is being litigated rather than settled.
The practical lesson for anyone writing an agent policy is about shape. A blanket refusal of a client type is the position that ends up in front of a judge, and it is hard to defend when the client was acting for your customer. A limit on a specific behaviour — how many units one session may buy, how fast an export may run — is a far more defensible thing to enforce, and it addresses the harm you actually care about.
What we would do
- Do not block it as a class. You would be refusing customers, and inviting the argument Amazon has been having.
- Decide per flow. Browsing, searching and comparing: allow. Checkout on limited stock, bulk export, account changes: require evidence of a person. See human verification.
- Do not tune on the user-agent. It is a claim rather than a credential, and impersonating a well-known agent is standard practice. Verify by the IP ranges operators publish, or not at all.
- Watch the aggregate. One agentic session is a customer. Four hundred of them converging on one product at release time is something else, and only the aggregate shows you which you have.
Agentic browser traffic in your logs?
If Comet or similar sessions are reaching your checkout and you are deciding what to allow, describe what you are seeing and paste a few request lines. We will tell you how we would decide it.
Frequently Asked Questions
What is Perplexity Comet?
A Chromium-based browser from Perplexity with an AI assistant built in, able to carry out multi-step tasks on a user's behalf. It launched for macOS and Windows in July 2025, became free for everyone in October 2025, reached Android in November 2025 and iOS in March 2026. The browser and assistant are free; autonomous background agents and premium models require Perplexity Pro or Max.
Is Comet traffic a bot?
It is automation driven by a real person's instruction, which is why the question is badly formed. The traffic comes from a genuine Chromium engine on a consumer connection, usually one user doing one task in one session. By behaviour it is a bot; by intent it is a customer. Blocking it blocks buyers, and treating it as human removes your control over an automated client.
What was CometJacking?
A prompt-injection attack disclosed by LayerX in 2025. A single crafted URL carried malicious instructions in a query-string parameter, telling the agent to consult its memory and connected services rather than search the web, and to exfiltrate emails and calendar data as an encoded payload. No credentials and no user interaction beyond opening the link were required. LayerX reported it to Perplexity on 27 and 28 August 2025, and Perplexity marked the reports not applicable, characterising it as a simple prompt injection with no impact.
Did Amazon win its case against Perplexity?
Not in the end. Amazon sought to stop Comet's shopping agent acting on its site, and a district court granted a preliminary injunction on 9 March 2026. The Ninth Circuit vacated that injunction on 4 August 2026, so the agent is not currently restrained. The underlying question — whether a retailer can refuse an agent acting for a logged-in customer — remains unsettled.
Should I block agentic browsers like Comet?
Not as a blanket rule, because you would be refusing customers. The policy that works is per-flow: let an agent browse, search and compare, and require evidence of a person at the points where automation at scale causes harm. That also keeps you out of the position Amazon found itself defending, which is a blanket refusal of a client type rather than a limit on a specific behaviour.
