The discrepancy began with two views of the same page. An ordinary reader did not see the opacity-zero instructions, but the assistant processed them while performing the requested task. Hidden content was not harmless simply because it was visually absent: its effect depended on what entered the agent’s context and which actions that agent could take. ##…
Inspect the ClaimsCase · DiggingBeagle record
Hidden HTML prompt injection caused a cross-origin data leak in Opera Neon
Hidden webpage instructions led Opera Neon’s assistant to retrieve an account email and send it elsewhere in a controlled test. Opera reproduced the issue and deployed a fix that the researchers retested; that result is limited to the demonstrated PoC.
Public disclosure: Oct 23, 2025
Scope
Researcher proof of concept against Opera Neon while the product was in Early Access. Brave demonstrated cross-origin data exfiltration, Opera independently reproduced the PoC, and both parties reported that the deployed fix stopped the demonstrated PoC. The Sources do not establish exploitation against ordinary users.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Impact
- Band 2 of 4
- Evidence
- Grade B
- Remediation
- fixed verified
- AI role
- AGAINST AI
Basis and provenance
Researcher and affected vendor disclosures agree on the demonstrated PoC and its retested fix. fixed_verified refers to their October 2025 retest, not execution by DiggingBeagle or a warranty for later versions.
Impact basis: The bounded experiment disclosed an account email across an origin/action boundary. No wider data set, real-user victim population or financial loss was established.
Assessed Oct 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-OPERA-NEON-HIDDEN-HTML · CLM-OPERA-NEON-CROSS-ORIGIN · CLM-OPERA-NEON-VENDOR-REPRO · Prompt injection flaw in Opera Neon · Prompt injection in Opera Neon: Rapid response through responsible disclosure
At a glance
## Similar mechanism, different remediation evidence The Comet case also illustrates an agent moving account information between origins, but the public accounts differ in what their retesting establishes. The comparison is useful precisely because it does not erase those differences. ## Data-protection context Where an actual deployment falls within…
Read the implicationsThe cited Sources do not establish in-the-wild exploitation or victims. Opera reproduced the PoC with an approximately 10% success rate and characterized exploitation complexity as high; this limits repeatability of the demonstrated attack but does not negate the underlying trust-boundary failure. The verified fix applies to the demonstrated PoC and does…
Limits and uncertaintyFull account
The discrepancy began with two views of the same page. An ordinary reader did not see the opacity-zero instructions, but the assistant processed them while performing the requested task. Hidden content was not harmless simply because it was visually absent: its effect depended on what entered the agent’s context and which actions that agent could take.
From page content to account data
Brave’s proof of concept directed Neon from an attacker-controlled page to the user’s authenticated Opera account, obtained the email address and sent it to an external destination. The result was a researcher-controlled data leak, not evidence that ordinary users had been compromised. It also did not demonstrate a wallet transfer or unrestricted access to every account in the browser.
Two accounts of the same test
Opera investigated and reported reproducing the PoC, including an approximately 10% success rate in its own testing. That percentage belongs to that test setup; it is not a probability for every user, prompt or future version. The vendor’s description of high exploitation complexity qualifies the conditions but does not negate a successful unauthorized disclosure in the experiments.
What the fix evidence supports
The disclosures identify a report on 14 October 2025, a production fix on 20 October and researcher confirmation on 21 October that the demonstrated PoC no longer worked. This is stronger evidence of a bounded remediation than an untested announcement alone. It still does not establish that all forms of indirect prompt injection were solved, or that a later version with different capabilities remains unaffected.
The broader design question
Rendering visibility and action authority are separate controls. Ignoring hidden text can reduce one route into the model, but visible documents can also contain adversarial instructions. A robust review therefore asks why a summarization task could access account data and transmit it, even after determining how the instructions were hidden. The essential authorization decision belongs at the action boundary, where the destination and sensitive data are known.
Mechanism and trust boundary
- 01
Process visually hidden page content
The assistant ingests instructions that were not displayed to the ordinary page reader.
- 02
Access a logged-in account
The controlled chain uses the authenticated Opera account to obtain its email address.
- 03
Transmit outside the original task
The account email is sent to an attacker-controlled destination.
Timeline
- Oct 14, 2025Event type unspecified
Brave reports hidden-HTML prompt injection to Opera
Brave submitted the Opera Neon prompt-injection issue through Bugcrowd.
- Oct 14, 2025notification
Vendor notified
- Oct 20, 2025Event type unspecified
Opera deploys a production fix
Opera reports that a fix was in production by 22:17:32 UTC on 20 October 2025.
- Oct 20, 2025patch
Fix date recorded
- Oct 21, 2025Event type unspecified
Brave confirms the demonstrated PoC no longer works
Opera reports that the researchers confirmed their PoC no longer worked after the update; Brave's disclosure likewise says follow-up testing found the vulnerability appeared patched.
- Oct 23, 2025Event type unspecified
Opera publicly describes the vulnerability and mitigation
Opera publicly documented its reproduction, risk assessment and remediation work.
- Oct 23, 2025disclosure
Public disclosure
Claims & evidence
CLM-OPERA-NEON-HIDDEN-HTMLBrave demonstrated that instructions placed in hidden HTML, including an opacity-zero element, were processed by Opera Neon's AI assistant as actionable content.supported
Basis: reported finding
- supportsPrompt injection flaw in Opera Neonprimary disclosure
Prompt injection via hidden HTML elements in Opera Neon, How the attack works, setup and injection steps
CLM-OPERA-NEON-CROSS-ORIGINThe proof of concept caused Neon to access the user's authenticated Opera account page, extract the user's email address and leak it to an attacker-controlled destination.supported
Basis: reported finding
- supportsPrompt injection flaw in Opera Neonprimary disclosure
Attack demonstration and Impact and implications, attacker website to auth.opera.com to attacker website flow
CLM-OPERA-NEON-VENDOR-REPROOpera said it validated the proof of concept but reproduced it with approximately a 10% success rate, assessed exploitation complexity as high, deployed a production fix and reported that the researchers subsequently confirmed their proof of concept no longer worked.supported
Basis: reported finding
- supportsPrompt injection in Opera Neon: Rapid response through responsible disclosurevendor statement
Case overview, Nature of the vulnerability, Impact evaluation and Opera's response and mitigation steps
- supportsPrompt injection flaw in Opera Neonprimary disclosure
Disclosure timeline, October 20-23 entries
Implications
Similar mechanism, different remediation evidence
The Comet case also illustrates an agent moving account information between origins, but the public accounts differ in what their retesting establishes. The comparison is useful precisely because it does not erase those differences.
Data-protection context
Where an actual deployment falls within GDPR scope, Articles 32 and 33 provide separate questions about risk-appropriate security and an actual personal-data breach. A controlled test is not a finding of noncompliance, and the cited material does not establish a reportable production incident. The technical review should retain facts about the data, recipients and access conditions so a qualified incident assessment can be made if a real event occurs.
Controls and mitigations
- Reported remediation: Opera deployed a fix on 20 October 2025, and the researchers retested their PoC on 21 October. This record does not independently certify later releases.
- DiggingBeagle recommendation: distinguish retrieved page data from user-authorized instructions and gate cross-account access or external transmission separately.
- DiggingBeagle recommendation: test hidden and visible instructions, authenticated destinations and task changes; hiding an instruction is only one delivery technique.
Unknowns and contradictions
- The cited Sources do not establish in-the-wild exploitation or victims.
- Opera reproduced the PoC with an approximately 10% success rate and characterized exploitation complexity as high; this limits repeatability of the demonstrated attack but does not negate the underlying trust-boundary failure.
- The verified fix applies to the demonstrated PoC and does not establish that every possible indirect-prompt-injection technique is eliminated.
- No ordinary-user victim count or financial loss is established by the disclosed PoC.
- The vendor’s test success rate is setup-specific and should not be generalized to other versions or attack variants.
Sources and citation
Material revision history
- Sep 25, 2026 · Published version · first publication · revision 50
- Oct 1, 2026 · Published version · material revision · revision 65Public fields changed: assessment_profile, attack_path, implications, links, mitigations, narrative, references, summary, unknowns
- Oct 8, 2026 · Published version · material revision · revision 100Public fields changed: ai_roles, concepts