Perplexity AI: A Double-Edged Breakthrough Driving Smarter Machines—and Easier Cybercrime

Per­plex­i­ty AI’s rapid evo­lu­tion from a niche “answer engine” into a multi­bil­lion-dol­lar search and pro­duc­tiv­i­ty plat­form has cap­ti­vat­ed tech­nol­o­gists and investors alike. Yet a par­al­lel sto­ry is unfold­ing: the same inno­va­tions that make Perplexity’s tools more accu­rate, ubiq­ui­tous, and lucra­tive are simul­ta­ne­ous­ly enlarg­ing the attack sur­face for data theft, phish­ing, dis­in­for­ma­tion, and intel­lec­tu­al-prop­er­ty abuse. The past six months have pro­duced a steady drum­beat of head­line-grab­bing inci­dents and research find­ings that illus­trate how a sin­gle AI start­up can unin­ten­tion­al­ly super­charge cyber-risk for pub­lish­ers, busi­ness­es, and every­day users.

The arti­cle below dis­sects sev­en dis­tinct vec­tors of misuse—each ground­ed in recent report­ing, tech­ni­cal analy­ses, or legal filings—and explains how they inter­twine to make both the AI ecosys­tem more intel­li­gent and the pub­lic more vul­ner­a­ble.

Anatomy of Recent Misuse—A Timeline at a Glance

Month 2025	Key Inci­dent	Abuse Cat­e­go­ry	Report­ed or Con­firmed Impact
Feb­ru­ary	Red­dit users doc­u­ment “Deep Research” hal­lu­ci­na­tions cit­ing non-exis­tent July 2025 sources	Mis­in­for­ma­tion loops	Erodes trust in aca­d­e­m­ic cita­tions
April	App­knox audit reveals six high-sever­i­ty flaws in Perplexity’s Android app	Mobile secu­ri­ty	Opens door to tap­jack­ing, root bypass, free API abuse
May	Mal­ware­bytes reports Comet brows­er designed to har­vest brows­ing data for tar­get­ed ads	Pri­va­cy inva­sion	Expands behav­ioral track­ing beyond query logs
June 19	WIRED inves­ti­ga­tion shows Per­plex­i­ty­Bot scrap­ing sites that block crawlers	Copy­right mis­use	Bypass­es robots.txt, threat­ens pub­lish­er rev­enue
June 27	Net­craft finds 34% of Per­plex­i­ty-sug­gest­ed login URLs uncon­trolled by brands	Phish­ing enable­ment	Directs users to mali­cious or unreg­is­tered domains
July 04	Ben­za­tine sum­ma­rizes Net­craft study; con­firms AI chat­bots send­ing users to scam links	Phish­ing enable­ment	High­lights real-world Wells Far­go phish­ing inci­dent
July 20	BBC sends legal threat over large-scale con­tent scrap­ing; demands com­pen­sa­tion	Copy­right mis­use	Sig­nals poten­tial injunc­tion against Per­plex­i­ty

1. Copyright Scraping and “Skip-the-Links” Plagiarism Feed an Underground Data Market

Perplexity’s core retrieval-aug­ment­ed gen­er­a­tion (RAG) pipeline hinges on real-time scrap­ing, but mul­ti­ple inves­ti­ga­tions show the com­pa­ny gath­er­ing entire articles—even those explic­it­ly pro­tect­ed by robots.txt—without per­mis­sion. The BBC warned in June that it may seek an injunc­tion unless exist­ing copies of its con­tent are delet­ed and future scrap­ing ends. Dow Jones and NYP Hold­ings went fur­ther, fil­ing a South­ern Dis­trict of New York law­suit accus­ing Per­plex­i­ty of “mas­sive ille­gal copy­ing” and trade­mark dilu­tion.

Illic­it­ly acquired pub­lish­er data has knock-on effects beyond lost ad rev­enue. Scraped archives become fod­der for phish­ing kits and malspam cam­paigns, because crim­i­nals can instant­ly remix cred­i­ble jour­nal­is­tic text, inject mali­cious links, and dis­trib­ute plau­si­ble-look­ing emails that bypass basic spam heuris­tics. The legal fight there­fore dou­bles as a cyber­se­cu­ri­ty bat­tle­ground: pre­vent­ing AI com­pa­nies from indis­crim­i­nate­ly har­vest­ing copy­right­ed prose also reduces the cor­pus avail­able to threat actors.

How Scraping Supercharges Cybercrime

• Auto­mat­ed pseu­do-jour­nal­ism: Forbes doc­u­ment­ed Per­plex­i­ty “knock-off sto­ries” that lift­ed frag­ments from inves­tiga­tive arti­cles with­out attri­bu­tion. These free text frag­ments let scam­mers craft con­vinc­ing lures at scale.
• API abuse vec­tors: Once scraped, pay­walled con­tent often resides in unse­cured cloud buck­ets or devel­op­er sand­box­es, a ripe tar­get for cre­den­tial-stuff­ing attack­ers look­ing to exfil­trate entire datasets.
• Trust dilu­tion: As AI-gen­er­at­ed sum­maries replace vis­its to orig­i­nal sites, users lose tra­di­tion­al trust sig­nals (pad­lock icons, known domains)—a per­fect envi­ron­ment for spoofed look-alike URLs.

2. Hallucinated Links Funnel Users Toward Phishing Domains

Large-lan­guage mod­els can mis­take sim­i­lar string pat­terns for ver­i­fied domains. Netcraft’s con­trolled exper­i­ment asked GPT‑4.1 fam­i­ly mod­els (deployed by Per­plex­i­ty) for the login page of 50 brands; 34% of 131 sug­gest­ed URLs were either dor­mant or entire­ly unre­lat­ed to the tar­get com­pa­ny. In one live test, Per­plex­i­ty pro­vid­ed a Google Sites phish­ing clone instead of wellsfargo.com.

Because AI chat inter­faces sum­ma­rize answers with­out the domain-by-domain rank­ing that users expect from tra­di­tion­al search, mali­cious links appear authoritative—deleting the fric­tion that his­tor­i­cal­ly gave peo­ple pause.

Why the Problem Persists

• Sparse brand rep­re­sen­ta­tion: Mid-size banks and util­i­ty por­tals appear infre­quent­ly in train­ing data, increas­ing hal­lu­ci­na­tion odds.
• Lack of rep­u­ta­tion scor­ing: Perplexity’s answer engine does not weigh estab­lished domain author­i­ty the way Google’s PageR­ank does, so typosquats slip through.
• User psy­chol­o­gy: Plain-lan­guage answers from a con­fi­dent chat­bot short-cir­cuit habit­u­al URL inspec­tion, accel­er­at­ing click-throughs to fake sites.

3. Critical Vulnerabilities in the Official Android App

App­knox researchers dis­closed six exploitable weak­ness­es in Perplexity’s Android client, includ­ing miss­ing SSL pin­ning and expo­sure to the Strand­Hogg priv­i­lege-esca­la­tion flaw. Attack­ers can hijack unse­cured net­work calls, over­lay phish­ing screens, and even repack­age the APK to inject mal­ware via the Janus vul­ner­a­bil­i­ty.

Sig­nif­i­cant­ly, one flaw lets users call Perplexity’s pre­mi­um APIs free of charge by tam­per­ing with local traffic—a rev­enue threat to the com­pa­ny, but also an invi­ta­tion for mali­cious bot herders seek­ing cost-free LLM access to craft spear-phish­ing emails.

Even when Per­plex­i­ty patch­es such issues, the broad­er ecosys­tem remains frag­ile: count­less mir­rors of old­er APKs cir­cu­late on shady app stores, and sup­ply-chain coun­ter­feit­ers can weaponize them long after offi­cial fix­es.

4. A Flood of Counterfeit Apps and Impersonation Schemes

Secu­ri­ty vlog­gers found dozens of Play Store list­ings mim­ic­k­ing Perplexity’s iconog­ra­phy but fun­nel­ing users into ad-laden or sub­scrip­tion-trap shells. The apps request intru­sive permissions—contact lists, cam­era, microphone—turning curi­ous first-time users into data donors for spam farms.

HardReset’s tear­down showed how to ver­i­fy the gen­uine devel­op­er sig­na­ture, yet fake apps still rank high in spon­sored search slots. Because Perplexity’s brand is itself new and its visu­al iden­ti­ty shifts quick­ly, recog­ni­tion fatigue aids impos­tors. The result: mal­ware authors har­vest query logs, loca­tion data, and even voice snip­pets under the guise of an AI assis­tant.

5. Comet Browser: From Answer Engine to Surveillance Hub

Perplexity’s July launch of the Comet brows­er extends LLM inte­gra­tion from search box to full device teleme­try. Mal­ware­bytes warns that Comet’s rai­son d’être is behav­ioral track­ing: CEO Aravind Srini­vas explic­it­ly said the firm wants insight into “what are you spend­ing time brows­ing … to build a bet­ter us”.

The stand­alone Comet Pri­va­cy Notice con­firms broad data col­lec­tion, includ­ing “pages viewed, scroll depth, and inter­ac­tion tim­ings,” which may be stored on over­seas clouds. Pri­va­cy advo­cates note that by pre-installing Comet on smartphones—talks con­firmed with OEMs in July—Per­plex­i­ty could observe 24×7 brows­ing habits, not mere­ly occa­sion­al AI queries.

Brows­er sup­ply-chain dom­i­nance cre­ates cas­cad­ing cyber-risk: if a mali­cious actor com­pro­mis­es Comet’s exten­sion frame­work or update chan­nel, the attack­er gains priv­i­leged, per­sis­tent access to pass­words and cook­ies across mil­lions of devices.

6. Misinformation Feedback Loops and “Second-Hand Hallucinations”

Per­plex­i­ty mar­kets itself as an anti­dote to Chat­G­PT-style hal­lu­ci­na­tions by attach­ing cita­tions. Yet GPTZero’s June study shows the cita­tions them­selves are increas­ing­ly AI-gen­er­at­ed; users encounter an AI arti­cle cit­ing anoth­er AI arti­cle, form­ing a closed loop of syn­thet­ic “author­i­ty”. Red­dit anec­dotes back this up: a user’s Chi­na land-reform report list­ed sources dat­ed “July 2025” months before that date exist­ed, and Per­plex­i­ty could not locate the links when chal­lenged.

As these phan­tom ref­er­ences prop­a­gate through social media, dis­in­for­ma­tion acquires the sheen of schol­ar­ly rig­or. Cyber­crim­i­nals seize on this dynam­ic to seed deep­fake “research” that legit­imizes pump-and-dump cryp­to tokens or health scams. Once LLMs ingest the new­ly mint­ed spam, the cycle repeats, embed­ding false­hoods deep­er into the knowl­edge graph.

7. Intensifying Legal and Regulatory Dragnet

Perplexity’s Accept­able Use Pol­i­cy explic­it­ly for­bids facil­i­ta­tion of cyber­crime, but enforce­ment lags behind scale. The com­pa­ny now faces pres­sure from three flanks:

1. Pub­lish­ers: BBC’s threat let­ter and News Corp’s law­suit demand dele­tion of infring­ing datasets and mon­e­tary dam­ages.
2. Cloud providers: AWS is inves­ti­gat­ing whether Per­plex­i­ty vio­lates scrap­ing rules; a neg­a­tive find­ing could sus­pend crit­i­cal com­pute resources.
3. Data-pro­tec­tion reg­u­la­tors: Cross-bor­der data trans­fers in Comet and enter­prise APIs raise red flags under GDPR and India’s DPDPA, as pri­va­cy lawyers note ambi­gu­i­ty around sub­con­trac­tor access.

If any one inves­ti­ga­tion forces Per­plex­i­ty to purge his­tor­i­cal logs or retrain mod­els from scratch, down­stream services—including What­sApp fact-check­ing bots that aim to com­bat scams—could become less reli­able overnight, iron­i­cal­ly under­cut­ting tools designed to fight mis­in­for­ma­tion.

Policy Implications and Risk-Mitigation Roadmap

For AI Developers

• Manda­to­ry domain-rep­u­ta­tion scor­ing: Inte­grate phish­ing black­lists and Cer­tifi­cate Trans­paren­cy logs before echo­ing links in answers.
• Cita­tion prove­nance audit­ing: Require cryp­to­graph­ic sig­na­tures or web-archive snap­shots to ver­i­fy that every cit­ed page exist­ed at crawl time.

For Regulators

• Licens­ing trans­paren­cy: Enforce pub­lic dis­clo­sure of con­tent-licens­ing agree­ments and scrap­ing exemp­tions to curb IP abuse.
• AI-spe­cif­ic pri­va­cy labels: Treat browsers like Comet as high-risk data proces­sors sub­ject to opt-in con­sent for behav­ioral track­ing.

For End-Users

• Ver­i­fy before click: Scru­ti­nize every domain sur­faced by AI tools, espe­cial­ly when asked to enter cre­den­tials.
• Install from first-par­ty stores: Con­firm devel­op­er names and pack­age hash­es to avoid coun­ter­feit Per­plex­i­ty apps.
• Use com­part­men­tal­ized pro­files: Sep­a­rate AI-pow­ered brows­ing ses­sions from online bank­ing to min­i­mize cross-site risk.