Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

SquareX released critical research exposing a hidden API in Comet that allows extensions in the AI Browser to execute local commands and gain full control over users' devices. The research reveals that Comet has implemented a MCP API (chrome.perplexity.mcp.addStdioServer) that allows its embedded extensions to execute arbitrary local commands on users' devices, capabilities that traditional browsers explicitly prohibit. Concerningly, there is limited official documentation on the MCP API.

Today's organizations of all sizes face increasing pressure to protect sensitive data, maintain compliance, and defend against sophisticated cyberattacks. At the same time, they must continue innovating, scaling, and delivering exceptional customer experiences. This dual mandate-security and growth-can feel at odds for many companies.