BragJack Attack Can Turn a Browser's Agentic AI Against It
_Pattara_Alamy.jpg?width=720&quality=80&disable=upscale)
A new attack, dubbed BragJack, has been discovered that allows attackers to hijack the AI assistants built into popular web browsers (Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude) and force them to perform malicious actions, such as accessing sensitive information and executing commands, without user interaction. Researchers at Forever Security demonstrated the vulnerability across five browsers, leading to bug bounties from the affected companies. The flaw stems from a design weakness allowing extensions to bypass security boundaries and directly control the AI agent. The discovery highlights a broader concern about the potential dangers of overly powerful AI agents and underscores the need for proactive security measures.
A new type of attack, BragJack, has been identified that leverages the AI assistants integrated into web browsers to compromise user security and data. Researchers at Forever Security discovered that attackers can bypass existing AI guardrails and directly manipulate these AI agents, forcing them to perform actions without any user interaction. The vulnerability affects five popular agentic browsers: Google Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude.
Contrary to typical AI attack methods, BragJack doesn’t rely on prompt injection, where attackers hide instructions within content to trick the AI. Instead, it exploits a fundamental design flaw: agentic browsers allow extensions to cross a boundary separating an untrusted extension from a highly privileged AI agent. This means that any user with even one extension installed on these browsers is potentially at risk.
In Google Chrome/Gemini, for example, Chrome blocked extensions from injecting scripts into Gemini’s page, but didn’t prevent an extension from modifying the network requests used to load Gemini. Researchers exploited this gap by substituting JavaScript from their own site, gaining control of the browser-side “body” of Gemini and enabling them to take screenshots, access local files, and activate the camera and microphone – all without user clicks.
Microsoft Edge/Copilot required a more complex approach, involving chaining two weaknesses. Researchers leveraged a Microsoft marketing page with special privileges to send prompts to the browser agent, then bypassed a network-level defense via a race condition between Edge’s “Think” and “Do” modes. This allowed them to get the agent to both accept their instructions and execute actions.
The discovery of BragJack is significant because it demonstrates a critical vulnerability in how agentic browsers interact with extensions, a scenario that has been raised by former Anthropic employees and current CEO. The potential for AI agents to be exploited to leak sensitive information and perform destructive operations is a serious concern.
To mitigate the risk, organizations should immediately update all Chromium-based browsers to the latest version and remove any extensions not vetted and from unknown sources. Security operations centers (SOCs) should monitor interactions between browser agents and their AI providers, looking for suspicious behavior and exporting transcripts to identify potential compromises. Looking ahead, organizations should consider adopting next-gen EDR solutions that can intercept operations made by agentic components on the endpoint and use enriched context and AI capabilities to distinguish safe operations from those that put the organization in danger.