BragJack Attack Can Turn a Browser's Agentic AI Against It

A new type of attack hijacks the AI assistant built directly into various browsers to access sensitive information, execute malicious actions, and exfiltrate data.

A new type of proof-of-concept attack called BragJack can compromise five agentic browser environments and steal secrets: Google Chrome with Gemini, Microsoft Edge , Opera Neon , Perplexity Comet, and Claude in Chrome.

Gal Weizman, an agentic software and browser vulnerability researcher at Forever Security, discovered the attack, which he said garnered the firm more than $20,000 in bug bounties from the companies affected, according to a blog post published today.

Contrary to most AI-based attacks so far, BragJack didn't require the researchers to bypass AI guardrails or even rely on prompt injection , where an attacker hides instructions in content that an AI agent is expected to read, Weizman wrote in the post.

"We discovered something worse," he wrote, adding that "all the vulnerabilities we discovered shared the same critical design flaw." That flaw involves how agentic browsers interact with extensions in such a way that attackers can hijack the communication channel completely and force prompts into the browser's built-in agent, making it do whatever they choose, he explains to Dark Reading.

Related: VectraRAT Can Hack Windows Enterprises for $250 per Month

"They didn't need to cleverly hide instructions in data the agent interacts with, hoping it would take the bait; they could just send one prompt after the other until the agent got convinced to do anything," Weizman says in an email interview. "Remarkably, this attack was effective against five of the most popular agentic browsers in the world, making it more than just a single vulnerability instance, but a novel type of attack."

Forever Security contacted the five companies affected by the attack: Google, Microsoft, Opera, Anthropic, and Perplexity. Each acknowledged that a vulnerability existed in each company's individual technology and awarded a bug bounty ranging from as low as $600 from Anthropic to as much as $7,000 from Google. Google and Microsoft even issued CVEs for the flaws in their Chrome and Edge agentic browsers: CVE-2026-0628 and CVE-2026-55945 , respectively. The issues have since been resolved.

The manifestation of BragJack in each browser was different, as each had a different vulnerability; however, the architectural problem exploited across browsers was the same. That is, each allowed a browser extension to cross a boundary that was supposed to separate an untrusted extension from a highly privileged AI agent. This means that any consumer who used any of the five browsers with at least one extension installed was at risk, amounting to hundreds of millions of users, according to Weizman.

Related: SpiderSilk Hunts External Threats With AI-Based Scanner

In Google Chrome/Gemini , for example, Chrome blocked extensions from injecting scripts into Gemini's page but did not prevent an extension from modifying the network requests used to load Gemini. The researchers used that gap to substitute JavaScript from their own site in a way that gave them control of the browser-side "body" of Gemini . This allowed them to take screenshots, access local files, and activate the camera and microphone, without user clicks, according to the post.

In another example, to implement BragJack in Microsoft Edge/Copilot, the researchers had to chain together two weaknesses because they faced stronger defenses, according to the post. First, they found a Microsoft marketing page with special privileges to send prompts to the browser agent. They then bypassed a network-level defense protecting that page via a race condition between Edge's "Think" and "Do" modes and, by switching modes at the right moment, managed to get the agent to both accept their instructions and execute actions.

BragJack: Proof of AI Agent Cyber Danger

BragJack is relevant not only because it demonstrates yet another way attackers can manipulate AI agents, but it also demonstrates the very scenario that inspired separate dire warnings over the weekend from a former Anthropic employee and its current CEO to rein in AI development — "how dangerous overly powerful agents (like the ones living in browsers) can be in the wrong hands," Weizman tells Dark Reading.

Related: ClickFix Campaigns Abuse Legitimate Services for Persistent Access

"The browser agents in this research agreed to do anything the attacking extension ordered them to, including accessing sensitive information (such as email correspondence), leaking it anywhere, and even performing destructive operations on any website the user is authenticated to," he says.

For this reason, the industry should heed the aforementioned warnings and proceed with caution to develop agents with "built-in constraints that would prevent them from completing tasks that may cause leakage of data or changes to system state before they become available to the public," Weizman says.

Take Defensive Action Now Against Browser Agent Hijacking

Organizations also should take immediate steps to defend against BragJack and other attacks that can occur if agentic browsers go rogue . In the immediate term, Weizman recommends that organizations keep every Chromium-based browser in the organization up to date and "remove any extension that the organization has not vetted and that is not well known and safe to use," he says.

While the attacks can bypass current endpoint detection and response (EDR) systems , there are ways that a security operations center (SOC) can set up detections by observing past interactions with the AI providers of each agentic browser and identifying potentially affected endpoints, Weizman tells Dark Reading. Once it's done this, the SOC "should export transcripts of interactions the browser agent had with its AI provider server and look for potentially suspicious behavior that may indicate a compromise," he recommends.

Looking ahead, Weizman adds, organizations also should consider adopting -gen EDR that intercepts operations made by agentic components on the endpoint and use enriched context and AI capabilities to distinguish safe operations from those that put the organization in danger.

Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Essential News & Insights from Black Hat USA 2025

Cybersecurity Outlook 2027

Cybersecurity Outlook 2027

Threat Exposure Analytics: Measuring and Communicating Security Risk

Threat Exposure Analytics: Measuring and Communicating Security Risk

Benchmark Scores Are a False Flag

Benchmark Scores Are a False Flag

Building an Effective Red Team: Beyond Penetration Testing

Building an Effective Red Team: Beyond Penetration Testing

How to Leverage Threat Intelligence Without Drowning: The Zero Noise Approach

How to Leverage Threat Intelligence Without Drowning: The Zero Noise Approach