Perplexity Comet agentic browser — unauthorized Amazon customer account access
Date: 2025-11
Affected: Perplexity AI Comet browser agent — Amazon customer accounts
Attack vector: agent-hijack
Category: real-world
Severity: Critical

Amazon lawsuit alleging Perplexity AI's shopping agent accessed private customer accounts without permission, masked automated activity as human behavior, and undermined account security via the Comet browser agent.

Impact: Privacy violation; unauthorized access; account compromise; federal lawsuit

Mitigations:
Agent identification headers (no human impersonation)
Explicit user consent for account access
Rate limiting and bot detection

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Agentic browser performs unauthorized account access
role: origin
label: Security & Compliance
notes: Privacy violation; unauthorized access; identity spoofing
role: impact