Perplexity’s Comet and the challenge of building an AI-first browser

In an era where Google Chrome commands over 65% of the browser market, the decision to launch a new browser might seem risky and, dare I say, even foolish. Yet in July 2025, Perplexity AI did exactly that with Comet, an AI-powered browser that promised to transform how we interact with the web. 

At the time of its launch, Perplexity’s blog announcement encouraged users to ask Comet about sensitive decisions like insurance and investment plans.

Its blog post read, “Accurate answers are the foundation of decision-making. This will compound in importance with agentic AI, when assistants make decisions for us, faster and more often. Comet is like a second brain, helping with the best possible decisions in every situation.”

Two months later, as security vulnerabilities emerge and market realities set in, the question is whether building search into AI, rather than integrating AI into existing search infrastructure, makes sense.

The timing of Comet's launch was audacious. Reports suggest that Perplexity AI has 22 million monthly active users and has achieved an $18 billion valuation. These numbers are impressive for an AI startup, yet tiny when measured against Google's ecosystem. Chrome alone serves billions of users worldwide, a user base that dwarfs Perplexity's entire platform. This disparity in scale shows the challenge facing any Chrome challenger: how do you convince billions of users to abandon ingrained habits for an unproven alternative?

The agentic promise: When browsers think and act

Perplexity positioned Comet not merely as another browser with AI features, but its vision centred on ‘agentic search’, an AI that doesn't just answer questions but takes actions on behalf of users. According to IBM Think's testing, Comet can execute complete workflows while keeping user context in mind, capable of finding and booking restaurants, sending emails through Gmail, and even navigating complex booking systems.

The distinction between Comet's approach and traditional browsers with AI add-ons is architectural. While Chrome offers Gemini as an extension and Google Lens as a sidebar feature, Comet's AI assistant is always present in the top-right corner of the browser window, offering end-to-end automation and context tracking. This presence allows for what Perplexity calls "conversational browsing", turning the web from a place you navigate to one that works for you.

Early reviews showcased this capability. The browser could pull up emails directly, surface emails for upcoming trips, find restaurants and book them, and even send emails that appeared indistinguishable from human-written language, according to reports. For complex tasks like navigating France's notoriously tricky train booking system, Comet's agentic capabilities showed promise when it worked correctly.

However, the gap between demonstration and daily utility quickly became apparent. In PCMag's week-long test by Ruben Circelli, Comet could clear out spam folders but struggled to add items to shopping carts, regularly getting stuck or failing. When it worked, it was usually slower than doing something yourself. This performance inconsistency highlights a challenge that faces agentic AI. There’s a difference between controlled demonstrations and the messy reality of diverse web interfaces and user expectations.

IBM Distinguished Engineer Chris Hay told IBM Think that Comet might behave differently for different tasks.

The security failure

The promise of agentic AI became a liability in August 2025 when security researchers at Brave discovered a critical vulnerability in Comet's structure. The flaw lies in how Comet processes webpage content: when users ask it to "Summarise this webpage," Comet feeds part of the webpage directly to its LLM without distinguishing between user instructions and untrusted content, allowing attackers to embed indirect prompt injection payloads that the AI executes as commands.

As per reports, an attacker could gain access to a user's emails from a prepared piece of text on a webpage in another tab, effectively turning Comet's cross-tab awareness, one of its key features, into a security nightmare. More troubling, Perplexity attempted to patch the vulnerability, but the fix did not work, according to Simon Willison's Weblog, suggesting deeper architectural issues with how the browser handles the boundary between user commands and external content.

This vulnerability exposes the tension. The more capable and autonomous an AI agent becomes, the larger its attack surface grows. Traditional browsers compartmentalise data and actions, but agentic browsers must break down these barriers to deliver their promised functionality. The result is a system where a malicious webpage can potentially access emails, banking information, or any other open tab, a trade-off that many users will find unacceptable.

A developer posted on X: "Why is no one talking about this? This is why I don't use an AI browser. You can literally get prompt injected and your bank account drained by doomscrolling on Reddit."

The security incident arrived at an unfortunate moment, as Perplexity was simultaneously launching Comet Plus, a $5-a-month subscription tier designed to share 80% of revenue with publishers whose content powers its AI, according to reports. 

While this revenue-sharing model addressed ongoing tensions between AI companies and publishers such as Dow Jones, The New York Times, Forbes, and Condé Nast, who have initiated lawsuits alleging unauthorised use of copyrighted content. The timing meant that potential subscribers were reading about Perplexity's commitment to publishers and its inability to secure their personal data simultaneously.

The Chrome gambit that wasn't

Perhaps recognising the impossibility of building a user base from scratch, Perplexity made headlines in August 2025 with a $34.5 billion all-cash offer to buy Chrome should Google be forced to divest it following the Department of Justice's antitrust case.

The acquisition strategy revealed Perplexity's deep understanding of the distribution challenge in browsers. Chrome represents one of the most powerful sources of new training data in existence, as per reports. For an AI company, access to Chrome's data streams would provide unparalleled insights into how people actually use the web, far beyond what any startup could gather independently.

However, the Chrome gambit ultimately showed the limits of disruption in mature markets. Google's antitrust case, which initially seemed likely to force significant structural changes, resulted in a much more modest outcome. Rather than divesting Chrome, Google was merely required to share search data, a requirement that, while potentially beneficial to competitors like Perplexity, falls far short of the access that owning Chrome would have provided.

As former Google executive Ari Paparo told Fortune, "the DOJ and the courts are not going to blindly empower a new monopoly just to replace the one they are breaking up." This regulatory realism highlights a broader challenge for any potential Chrome successor.

Should it be AI-first or AI-enhanced?

The failure of Perplexity's Chrome acquisition attempt forces a deeper examination of the choices facing companies building AI-powered browsers. The question is whether it's more effective to build search capabilities into an AI platform or to integrate AI capabilities into an existing search platform.

Google's approach takes the latter strategy: taking an established search infrastructure that processes billions of queries daily and gradually integrating AI capabilities. Chrome has integrated Gemini into search, Google Lens sidebar features, and tab comparison tools. The advantage is clear: Google can introduce AI features to billions of existing users without requiring them to change their browsing habits.

Perplexity's approach with Comet takes the former strategy: building a browser around AI capabilities from the ground up. This allows for deeper integration and more sophisticated agentic behaviours, but it requires users to abandon familiar workflows and trust a new platform with sensitive data. We generally use Google, and it’s a wonder whether this is likely to change in the near future.

The market response suggests that users prefer evolution to revolution. Despite Comet's innovations in agentic AI, adoption has been limited to Perplexity's existing user base and early adopters. Currently available to Perplexity Max subscribers at $200 per month, Comet is being rolled out by invitation only over the next few weeks. 

While CEO Aravind Srinivas compared the demand to Gmail's early launch on LinkedIn, Gmail succeeded because email was fragmented across multiple providers, but browser usage is dominated by a single platform.

The structural advantages of Google's position extend beyond user numbers. Chrome's integration with Google's broader ecosystem, from search to Gmail to Google Workspace, creates switching costs that go far beyond browser preferences. Users would need to replicate not just their bookmarks and extensions, but their entire digital workflow around a new platform. 

The security vulnerabilities discovered in Comet highlight another asymmetry between AI-first and AI-enhanced approaches. When Google adds AI features to Chrome, those features operate within an established security framework developed over decades of browser evolution. When Perplexity builds AI into Comet from the ground up, every interaction between the AI and web content creates potential security implications that traditional browsers never had to consider. 

Looking ahead, while the Comet browser shows innovation in agentic AI and offers features that traditional browsers cannot match, it enters a market where the existing browsers possess advantages in distribution, data, and user loyalty. 

In a market where Google and Apple still own nearly 85% of global browser traffic, the challenge is convincing users that better technology is worth the disruption of change.