Disclosed vulnerability
Opera Neon AI assistant follows instructions hidden in zero-opacity HTML and leaks the user's account email
AIR-2025-0156 AIR record · 2025-10-opera-neon-prompt-injection
From the supporting source
By embedding hidden or malicious instructions within a webpage, an attacker could manipulate the AI to perform unintended actions.blogs.opera.com
The record
Disclosed
2025-10-23
Vendor
Opera
Product
Opera Neon
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Opera Neon followed hidden instructions and transmitted the account email
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection hidden html
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Opera Neon users lured to a malicious page and issuing the triggering command
Capability abused
Defense & remediation
Recorded defense
Opera Neon built-in mitigations (which Opera says contain such attacks)
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
yes - fix deployed to production 2025-10-20 22:17 UTC, ~6 days after report; researcher confirmed 2025-10-21
Taxonomy & references
Curator notes
Reported by Brave via Opera's Bugcrowd program on 2025-10-14; initially closed as 'Not Applicable' on 2025-10-17, then embargoed and fixed. Demonstrated: read the user's email address from their logged-in Opera account page and send it to a third-party server; Brave notes the same primitive reaches card details on a logged-in banking site. Opera rates attack complexity high (requires luring plus the right user command). Contrast with Perplexity's handling of the analogous CometJacking report, which stayed closed.
Supporting sources
Cite as
Enkrypt AI. "Opera Neon AI assistant follows instructions hidden in zero-opacity HTML and leaks the user's account email". AIR, AIR-2025-0156. https://agentincident.vercel.app/i/AIR-2025-0156/ (accessed 2026-10-19).