Single Extension Hijacks AI Agents in Five Browsers Without Any User Clicks

A single malicious browser extension — the kind with permissions so common that ad blockers routinely request them — is all it takes to seize complete control of the AI agents now built into five of the world’s most widely used browsers, giving an attacker the ability to read local files, capture screenshots, turn on a camera, and impersonate users to their own email and accounts, with zero interaction from the victim.

Security researcher Gal Weizman of Forever Security published the findings on September 16, 2026, under the name BragJack. The targets were Google Chrome’s Gemini Live, Microsoft Edge’s Copilot agent, Opera Neon, Perplexity Comet, and Anthropic’s Claude in Chrome extension. Google and Microsoft have patched their assigned vulnerabilities — CVE-2026-0628 in Chrome and CVE-2026-55945 in Edge — but patch status for the other three products remained unconfirmed at the time of the research’s public release. The research earned Weizman more than $20,000 in bounties across all five vendors.

What Makes Prompt Forcing Different From What Came Before

The security community has spent the past two years focused on prompt injection — the technique of hiding malicious instructions inside content an AI agent is already reading (a webpage, a document, an email) and hoping the model treats those hidden words as commands. Prompt injection is a guerrilla attack: the attacker sneaks words into an ongoing conversation and hopes the AI gets confused about who is talking.

Prompt Forcing, the technique Weizman introduced with BragJack, is something structurally different. Instead of hiding instructions inside content the AI reads, an attacker using Prompt Forcing hands the agent an entirely attacker-crafted prompt and then continues to issue follow-up commands. There is no AI guardrail to fool, because the attacker has bypassed the AI’s normal input channel entirely and is speaking directly to the browser component that carries out the agent’s instructions.

The practical result is an attack with no malicious code. The component taking action is the browser’s own legitimate AI agent, using its legitimate elevated permissions, following instructions that are a perfectly normal sentence in English. An endpoint detection and response (EDR) tool — software that monitors computers for malicious executables, suspicious code patterns, and anomalous system calls — has no clear signal to act on. As Weizman put it in his research: EDRs are not built to detect attacks written in plain English.

This matches a broader assessment from the security industry. Morphisec analyst Brad LaPorte noted in June 2026 that AI-driven attacks outpace detection, calling out the fundamental architectural limitation: even advanced systems must observe behavior, interpret signals, determine malicious intent, and initiate response — a sequence that introduces delay that AI-speed attacks can exploit.

How Did a Network-Traffic API Become a Master Key?

All five BragJack attacks share a single technical root: Chromium’s declarativeNetRequest (DNR) API, a browser extension capability available since Chrome 84 that lets extensions modify how network requests are handled — redirecting resources, adjusting response headers, blocking connections — without the extension needing to read the content of those requests.

DNR was designed as a privacy improvement over an older API that gave extensions full visibility into every network request. It is the mechanism that powers ad blockers, coupon finders, and countless productivity tools. It requires only the declarativeNetRequest permission, one of the lowest-friction Chrome extension permissions in Chrome’s extension system and one that triggers no unusual installation warning.

Browser vendors had anticipated that extensions might try to inject malicious JavaScript directly into privileged AI components. Their defense was to block that injection — extensions cannot run content scripts on chrome://glic (Chrome’s internal Gemini component), on perplexity.ai, or on other trusted AI domains. What vendors did not adequately anticipate was that blocking script injection into a page is not the same as blocking DNR rules from intercepting that page’s network traffic. Weizman found that by using DNR rules to intercept the JavaScript resources a privileged AI page loads, he could substitute his own code — code running inside the trusted page’s context, which the AI body accepts as authoritative.

Browser by Browser: What the Extension Could Do

The capabilities differed significantly by target. Weizman summarized the attack surface in a table published with his research:

Google Chrome — CVE-2026-0628, $7,000 bounty (patched January 2026) The worst-case target for raw data access. Once an extension exploited the DNR gap in how Chrome loaded its Gemini web app, it could read local files from the operating system, take screenshots, and activate the camera and microphone — all without user interaction. CISA rated this vulnerability 8.8 out of 10. Google patched Chrome version 143.0.7499.192 in January 2026.

Perplexity Comet — $7,000 bounty (patch status unconfirmed) Weizman called Comet "the most devastating" target, and the reason is architectural: Perplexity built Comet as a fully agentic browser in which the AI agent holds all the permissions the browser itself holds, including operating system file access. Rather than attacking the main perplexity.ai domain, which was locked down against extension scripts, Weizman found a development domain — testing.perplexity.com — left active in the production browser’s code. A redirect normally sends any visitor back to the main site, but a redirect is a header in a network response, and DNR rules can strip headers. Removing the redirect let the extension land on the testing domain and inject commands. The resulting access included screenshots, browsing history, local file reads, and the ability to direct the AI agent to take arbitrary actions — including exfiltrating email to an external address.

Microsoft Edge — CVE-2026-55945, $5,000 bounty (patched July 2, 2026) Microsoft had anticipated the extension-based attack and tried to block it. Edge’s Copilot agent was split into two modes: "Think" mode accepts prompts and reads pages; "Do" mode can take actions but not receive new prompts. The two were designed to never operate simultaneously. Weizman’s solution was a race condition: put the agent in Think mode, inject the malicious prompt, then immediately switch to Do mode before the security state transition completed. The agent acted on the attacker’s instructions during the brief window before the restriction re-engaged. CISA scored this race condition CVE-2026-55945 at 4.2 (Medium), and Microsoft patched Edge version 150.0.4078.48 on July 2, 2026.

Opera Neon — $900 bounty (patch status unconfirmed) The simplest of the five attacks, and in some ways the most revealing. Opera’s AI agent trusted the opera.com domain — but Opera had not blocked extensions from running scripts on that domain. Weizman injected code directly, without needing the DNR trick, and could immediately issue commands to the agent. Notably, Opera found the same flaw independently at around the same time and still paid the bounty.

Anthropic Claude in Chrome — $600 bounty, medium severity (patch status unconfirmed) Weizman acknowledged this was the least severe finding in the research. Claude in Chrome is itself a browser extension rather than a built-in browser component, which means the attack was one extension exploiting another — a meaningfully lower risk profile than an extension exploiting a full browser. Anthropic had nonetheless created a marketing page capable of sending prompts to the Claude side panel without restricting which prompts that page could send. Since Claude in Chrome cannot prevent other extensions from running on claude.ai, Weizman injected code and demonstrated exfiltrating email summaries to an external address.

Claude for Chrome: A Pattern of Extension Vulnerabilities

BragJack is the third time Claude for Chrome has drawn security scrutiny in 2026. In April, security firm LayerX disclosed ClaudeBleed, a trust-boundary design flaw in which the extension accepted commands from any script running under the claude.ai origin without verifying whether that script came from Anthropic or from code injected by another extension. The attack allowed an extension with no declared permissions to instruct Claude to share Google Drive files, send Gmail messages, extract GitHub repository code, and delete evidence of the interaction — all without meaningful user consent.

Anthropic shipped a fix that narrowed which prompts an outside page could feed into Claude, restricting the extension’s exposure to a fixed set of pre-approved tasks. But Manifold Security subsequently reported in July that the mechanism used to activate those tasks did not verify whether the triggering click came from a real user — meaning another extension could simulate the interaction and set the process in motion. That weakness remained reproducible eight releases after Manifold’s initial disclosure.

Why Existing Defenses Cannot Catch This

Traditional endpoint security assumes that harmful actions involve harmful code. An EDR product monitors for malicious executables, suspicious system calls, unusual file-access patterns, and abnormal network connections. When the Chrome browser’s Gemini assistant takes a screenshot and saves it to a path the attacker controls, the action is performed by a trusted process (Chrome) using an API it is legitimately authorized to use, in response to an instruction that is a sentence in English. There is no binary payload, no shellcode, no exploit kit.

Trend Micro’s 2026 threat landscape analysis described the same structural problem: AI agents in enterprise environments — the ones with broad API keys, long-lived secrets, and access to sensitive data — are quickly becoming a high-value target, and the endpoint is now where the human, their identity, the data they touch, and the AI tools they — or an attacker — are running converge.

Is This Happening in the Wild?

Not through BragJack specifically. As of September 16, 2026, neither CVE was listed on the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, and no evidence of wild exploitation showed any of the five BragJack methods being used in an actual attack. Every BragJack demonstration requires the attacker’s extension to already be running in the victim’s browser — the same prerequisite as most other extension-based attacks.

That prerequisite has not stopped comparable attacks from reaching millions of users through other means. In July 2025, the Urban VPN Proxy extension silently updated its code to intercept AI conversations from ChatGPT, Claude, Gemini, and Microsoft Copilot across more than 8 million Chrome and Edge installations, harvesting and selling conversations to advertisers. In January 2026, OX Security discovered two extensions impersonating AI assistants — one carrying Google’s "Featured" badge — that had accumulated more than 900,000 installs and were exfiltrating AI conversation histories to attacker-controlled servers every 30 minutes.

BragJack is not a report that attacks are happening — it is a proof of concept of what attacks could do. The gap between the two has narrowed steadily over the past year.

What Researchers Know About the Underlying Architecture

The through-line in BragJack’s five attacks is not any specific implementation error — it is the security model. Each browser tried to protect its AI component by designating exactly one trusted webpage whose commands the component would execute. The assumption behind this model is that restricting which page can command the AI body is equivalent to restricting what the AI body does.

Weizman’s research demonstrates that this assumption is incomplete. Restricting content script injection protects the trusted page’s own code. It does not protect the network traffic the trusted page makes. An extension that cannot run code on perplexity.ai can still intercept the JavaScript files perplexity.ai loads from Perplexity’s servers. Replacing one of those files with attacker-controlled code puts code into the trusted page’s execution context without ever touching the page directly.

Patching the individual bugs — updating the Chrome version, updating the Edge version — closes the specific path Weizman used. The underlying architecture, in which one trusted webpage serves as the sole authorization boundary for a highly privileged AI agent, remains in place. Every browser that adopts this model and gives an AI agent elevated privileges will need to treat AI-agent communication channels as a privilege category distinct from and higher than ordinary web access. The bug bounty patches address what Weizman found. They do not address what the next researcher will find in a different corner of the same design.

How to Protect Your Browser AI Today

Keep all browsers and browser extensions fully updated. Google and Microsoft have patched their assigned CVEs; the update for Chrome shipped in January 2026 and the Edge update in July 2026. Users of Perplexity Comet, Opera Neon, and Claude in Chrome should ensure their software is current and monitor for security updates from those vendors.

Audit your installed extensions. Open your browser’s extension management page and review everything listed. Remove anything you do not recognize, no longer use, or cannot explain. An extension that requests "read and change all your data on all websites" has the permissions needed to attempt a BragJack-style attack — not all extensions with that permission are malicious, but each one that holds it expands your attack surface.

For Claude in Chrome specifically, disable the "Act without asking" setting. In that mode, the extension executes actions without a confirmation prompt for each one, removing the opportunity for a user to catch an unexpected request in progress. With confirmation prompts active, a synthetic click from a malicious extension that tries to trigger a task will produce a visible confirmation dialog.

Consider whether you have activated AI browser agents at all. The capabilities that make AI agents useful — the ability to read your email, access your files, take screenshots, and act on websites on your behalf — are the same capabilities that make them valuable targets. Until the security architecture of these integrations has matured through further hardening and public research, each enabled AI agent capability represents a decision about an accepted risk.

---

Frequently Asked Questions

What is Prompt Forcing, and why is it more dangerous than prompt injection?

Prompt injection hides malicious instructions inside content an AI is already reading — a webpage or document — hoping the model treats the hidden words as commands. The AI’s safety training may catch it, or the instruction may not work if the hidden text is formatted oddly. Prompt Forcing skips all of that: the attacker hands the agent an entirely attacker-crafted prompt and then issues follow-up commands, speaking directly to the browser component that carries out instructions. There is no AI guardrail in the path, because the attacker bypassed the normal input channel entirely. The result is an attack with no code artifacts for security tools to detect — only a sentence in English directing legitimate software to do something harmful. The Forever Security research blog details the full technical mechanism.

Do I need to update Chrome and Edge, or is there something else I need to do?

If you use Chrome, update to version 143.0.7499.192 or later (released January 2026). If you use Edge, update to version 150.0.4078.48 or later (released July 2, 2026). For Perplexity Comet, Opera Neon, and Claude in Chrome, keep those products updated and audit your installed extensions, since patch dates for BragJack-specific techniques in those products had not been confirmed publicly by the researchers’ disclosure date.

Has BragJack been used in actual attacks?

No. As of September 16, 2026, neither CVE appeared on the US government’s Known Exploited Vulnerabilities catalog, and no public evidence showed any of the five BragJack methods being used against real users. All the demonstrated attacks are proof-of-concept research that requires a malicious extension to already be present in the victim’s browser. Related but simpler attacks — extensions that steal AI conversation histories rather than hijack AI agents — have reached millions of users through official browser extension stores and are documented real-world incidents.

Will patching the specific bugs fix the underlying problem?

Patching the bugs closes the specific paths Weizman demonstrated. It does not change the foundational architecture: each of these browsers designates one trusted webpage as the sole authorization boundary for a powerful AI agent, and BragJack demonstrated that an extension can seize that trusted page without injecting scripts directly into it — by using the network-modification permissions that ordinary extensions already hold. As long as AI agents with browser-level privileges rely on a single trusted-page model without treating AI-agent communication channels as a separate, higher-privilege category, the class of attack BragJack represents will remain viable for future researchers working in different corners of the same design.