December 2025 Summaries

A Perplexity and Harvard study analyzing hundreds of millions of anonymized Comet and Comet Assistant interactions finds that AI agents are used primarily for cognitive work rather than only routine delegation, with 57% of activity involving productivity, workflow, learning, or research tasks. Productivity and workflow account for 36% of common tasks, while learning and research represent 21%, with users employing agents to gather information, synthesize materials, analyze options, and support decisions across fields such as procurement, education, and finance. The study reports that many users begin with casual requests such as travel or entertainment recommendations but increasingly shift toward higher-value professional and research applications, which show stronger retention. Six occupational groups account for 70% of agent activity, with digital technologists generating 30% of queries, while marketing, sales, management, and entrepreneurship display especially intensive ongoing use after adoption. Usage also varies by context, as finance users focus heavily on efficiency, students on research and learning, and other professions on industry-specific needs, while personal uses account for more than half of all query volume.

Perplexity has announced a global partnership with Cristiano Ronaldo, presenting the football star’s career-long emphasis on discipline, consistency, and self-improvement as aligned with the company’s AI answer engine. Ronaldo, described as a frequent Perplexity user, will serve as more than a sponsor and has also invested in the company, reflecting Perplexity’s view that trusted AI can support preparation and decision-making in high-stakes settings. To launch the collaboration, Perplexity is introducing an interactive CR7 hub where fans can explore Ronaldo’s career, view rare images, revisit notable goals, and access curated questions and stories, with further content, experiences, and merchandise planned during the partnership.

Comet’s developers describe a security evaluation of browser-based AI agents, which face prompt-injection risks from malicious instructions embedded in webpages that can influence actions across authenticated services. To better reflect real browsing conditions, they created BrowseSafe-Bench, a synthetic benchmark that combines attack objectives, injection locations such as visible text or hidden HTML, and linguistic styles including stealth, indirect, and multilingual phrasing within noisy, realistic pages containing difficult benign examples. Their fine-tuned BrowseSafe model, built on a Mixture-of-Experts architecture, reportedly achieved an F1 score of about 0.91 while operating fast enough for asynchronous production scanning, outperforming smaller classifiers and approaching or exceeding larger models that often require slower reasoning. The evaluation found that visible malicious text, linguistic camouflage, language switching, and benign command-like distractions make attacks substantially harder to identify. Because no detector can fully prevent novel attacks, the proposed defense-in-depth system treats retrieved web content as untrusted, uses a fast classifier for broad screening, routes uncertain cases to more capable reasoning models, and uses flagged examples to generate new training data and adapt to emerging threats.

BrowseSafe is an open-source, real-time detection model and accompanying BrowseSafe-Bench benchmark designed to protect browser-based AI agents from prompt injection attacks embedded in untrusted web content. As agents increasingly read and act on entire pages, malicious instructions can be concealed in comments, templates, invisible HTML attributes, form fields, footers, or ordinary-looking multilingual text to redirect an agent from a user’s intended task. BrowseSafe scans page HTML before an agent processes it, offering a faster and less costly alternative to applying general-purpose language models to every page, while BrowseSafe-Bench provides 14,719 realistic malicious and benign examples spanning 11 attack types, nine placement strategies, and three language styles. Evaluation indicates that explicit attacks are generally easier to identify, whereas indirect, multilingual, and visibly placed injections are more difficult, exposing limitations in detectors that associate threats mainly with hidden content. The model is intended as one component of a defense-in-depth system that also limits tool permissions, treats web-derived data as untrusted, and requires user confirmation for sensitive actions.