Is Perplexity Comet Safe and Free? Pricing, Security Risks and Who Should Use It (2026)

Perplexity Comet is free to download, which makes the first question easy. The second one is harder: is Perplexity Comet safe when it can read your pages, click buttons and act inside accounts you are already logged into? Security researchers have shown that an AI browser agent can be tricked by the very pages it reads, and the legal picture changed this year too.

This guide covers what is free and what is not, what researchers found, what the Amazon court order means for shopping, how Comet compares with other AI browsers, and a practical way to use it without handing it the keys. Figures were checked on October 17, 2026. Most of the security disclosures date from 2025, and we could not confirm the current state of every fix, so we flag that where it matters. This is general information, not security advice for your organization.

Is Perplexity Comet safe? The short answer

Comet is safe enough for low-stakes research on public pages, and not a good choice for anything involving banking, health, work admin consoles or private email when its agent is switched on. The reason is not that the browser is badly built. It is that an agent acting with your logins can be steered by hidden text on a page, and researchers have demonstrated exactly that against Comet. We did not find a published independent security audit of the browser.

What is free and what is not

According to eesel's June 2026 pricing guide, the Comet browser has been free for everyone since October 2, 2025, on Mac, Windows, iOS and Android, with no account needed for basic browsing. That includes the assistant, one-click page summaries, ad blocking and voice mode. Treat the plan details as indicative: eesel sells competing products and its figures were not verified against Perplexity's own pages, so check the live pricing page.

Sources disagree slightly on how much agent use is included for free. eesel says free agent tasks use a small credit allowance, while TechRepublic's September 2026 comparison says browser-agent queries start with Perplexity Pro at $20 a month. Test the free tier on one task before you plan around it. If you are weighing the subscription itself, see our Perplexity review.

What security researchers found

Three findings come up repeatedly. All are from 2025, so check whether they still apply to the version you use.

1. Indirect prompt injection (Brave, August 2025). Brave found that Comet's "summarize this page" feature passed page content to its model without separating your instructions from untrusted web text. Attackers could hide instructions in white-on-white text, HTML comments or user comments, and the model could follow them as if you had typed them. In Brave's proof of concept, the hidden text led Comet to read an email address, trigger a login code, read that code from a logged-in Gmail tab and send both to the attacker. Brave's full write-up gives the timeline: reported July 25, a first fix on July 27, a retest that found the fix incomplete, and a public disclosure on August 20. Brave later updated the post to say further testing showed the issue had not been fully mitigated.

2. CometJacking (LayerX, October 2025). The Hacker News reported LayerX's finding that a crafted link could make the agent check its memory and pull data from connected services such as Gmail, encode it and send it out. Perplexity classified the findings as having no security impact, so the two sides disagree on severity.

3. Social engineering of the agent (Guardio Labs). Reported through secondary coverage, this showed an agent being steered to a phishing page without any hidden injection at all. We could not verify the details from a primary source, so treat it as a pointer rather than a fact.

A broader note from TechRepublic: a University of Washington study found agentic browsers can weaken same-origin protections. In TechRepublic's own test, Comet was not compromised by the method they used, but the article still advises keeping sensitive accounts out of agent sessions. Test results and real-world exposure are different things.

The Amazon court order, and what it means for shopping

Amazon sued Perplexity in November 2025 under the federal Computer Fraud and Abuse Act and a California statute over Comet's shopping agent. In March 2026, per Decrypt's report, a federal judge in San Francisco granted a preliminary injunction that blocks Comet from making purchases on Amazon for users, stops it accessing password-protected Prime accounts and requires Perplexity to destroy the Amazon customer data it collected. The order was stayed for seven days to allow an appeal, and we could not confirm whether one was filed.

Perplexity argued that Comet simply automates what users direct, so it inherits the user's permissions. The court rejected that view at least for now. This is a preliminary order, not a final ruling. The practical lesson for you is narrower than the headline: an AI agent that acts as you on a site that has not authorized it can be blocked, and the rules are still being written.

How Comet compares with other AI browsers

TechRepublic grouped the main options by use case in September 2026. Prices and security notes below are from that comparison, so check them before you buy:

On how Comet feels to use, Cybernews' review concluded that Comet was not ready to fully replace Chrome, citing performance, stability and extension maturity, and found cross-tab references inconsistent when they worked and memory recall unreliable in its test. That review's page text is dated October 2025, so the product may have changed. A separate October 2025 comparison from Techloy described Comet as stronger on research and citations and ChatGPT Atlas as stronger on task automation. For the wider field of assistants, see our guide to the best AI chatbots, Gemini, Microsoft Copilot and ChatGPT.

How to use Comet more safely

Brave's recommendations for AI browsers, plus TechRepublic's advice, translate into a short routine:

1. Use a separate profile. Keep one profile for agent work with no banking, work or health logins, and another without the agent.
2. Log out before you run the agent. Close your email and any admin panels first, so there is nothing for a hidden instruction to read.
3. Be wary of user-generated pages. Forums, comment sections and unknown sites are where hidden text hides.
4. Never enter payment details in an agent tab. Check out yourself.
5. Read every confirmation prompt. Brave recommends explicit confirmation for sensitive actions such as sending email.
6. Do not connect your inbox or calendar unless you need to. Fewer connections means less to leak.
7. Decide per session, not per browser. Low-stakes research is different from anything involving money or private data.

The same logic applies to any AI agent with write access. Our guide on connecting an AI agent to your CRM or Stripe safely covers it for business systems, and how AI agents actually work explains why they are easier to steer than a normal app.

If you run a team

If staff install AI browsers on work machines, you have a shadow AI question as well as a security one. Our shadow AI audit shows how to find the tools your team already uses, and the AI tool contract checklist covers the data terms to read first. Our overview of the best AI agents helps you decide where an agent belongs at all.

Who should use Comet, and who should not

Final thoughts

Comet is free, capable and genuinely useful for public research. It is also an agent that acts with your logins, and researchers have shown that this kind of agent can be steered by hidden text. Whether it is safe depends less on the browser than on what you let it touch.

Try it for three days on your normal reading and research, in a separate profile, with your sensitive accounts logged out. Judge it from that experience rather than from a features list, and re-check the security situation whenever a major update ships. For more on where agents are heading, browse our AI chatbots category.