BragJack 2026: AI Browser Agent Hijack Hits UK IT

What Forever Security disclosed

Security researcher Gal Weizman of Forever Security published a proof-of-concept called BragJack, showing that a malicious browser extension already installed on a victim's machine can hijack the AI assistants wired into five Chromium-based browsers or browser tools: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Anthropic's Claude in Chrome, according to BleepingComputer.

Once the malicious extension was present, the abuse could run without further user interaction, letting the extension control an AI browser agent and misuse its existing privileges to reach sensitive data or take action on the victim's behalf. The disclosure earned more than $20,000 in bug bounties across the five vendors, with individual payouts ranging from $600 to $7,000, and produced two CVEs. Google and Microsoft have since fixed the flaws assigned to them.

Why this matters for UK infrastructure buyers

UK organisations are increasingly letting browser-based AI agents summarise inboxes, pull data from internal portals, and act across tabs on a user's behalf. BragJack demonstrates that the trust chain underpinning that convenience — a browser extension that ordinarily only sees web content — can, in some designs, become a route into files, browsing history and even camera or microphone access.

That is a direct data exfiltration risk, not a theoretical one: Weizman demonstrated forcing an agent to visit Perplexity, summarise a victim's emails, and send the results to another address. For infrastructure teams that have not yet mapped which extensions can talk to which AI agents, this is exactly the kind of lateral movement path that protecting your endpoints from malicious extensions is designed to close.

The 'brain and body' problem behind Prompt Forcing

Weizman frames modern browser AI as having a 'brain' — the model that decides what should happen — and a 'body', a privileged browser component that actually performs actions such as opening tabs, reading content or taking screenshots. The attack, which he calls Prompt Forcing, differs from ordinary prompt injection: rather than sneaking malicious text into content an AI is already reading, the attacker hands the agent an entire prompt and follow-up instructions, which the agent then converts into legitimate browser actions using its own privileges.

The technical route relied on Chromium's declarativeNetRequest functionality, which lets extensions alter network requests, weaken response headers and redirect resources. Using this, the same extension intercepted traffic trusted by each vendor's privileged AI component, without needing to touch the protected component directly.

How the five targets differed

Chrome's Gemini Live was compromised by weakening security headers and redirecting a JavaScript resource inside the embedded Gemini web app, giving the attacker code execution that spoke directly to Chrome's privileged AI component. This earned CVE-2026-0628 and a $7,000 bounty.

Perplexity Comet went further because its agent can act on websites, not just read them: a testing domain trusted by the built-in agent extension lacked the same protections as the main site, allowing history, screenshots, local files and direct control of the agent. Microsoft Edge had split its agent into 'Think' and 'Do' modes specifically to prevent this class of abuse, but a race condition — assigned CVE-2026-55945 — briefly disabled that restriction long enough to force an action before the agent re-checked its state. Similar flaws were demonstrated against Opera Neon and Claude in Chrome, the latter itself running as a browser extension rather than a standalone browser.

What UK teams should do now

This disclosure sits alongside earlier extension-based AI risks, including the ClaudeBleed flaw reported by LayerX and separate research showing browser extensions quietly harvesting chat content from platforms including ChatGPT, Claude, Gemini, Copilot and Perplexity. The pattern is consistent: extensions and AI agents are being handed browser-level trust faster than governance is catching up, which is why understanding machine identity security for AI agents is now a board-level question rather than a technical footnote.

Practical steps for infrastructure teams include auditing which extensions have 'read and change all your data on all websites' permissions, removing anything unrecognised or unused, keeping browsers on current patch levels, and treating AI browser agents as privileged identities requiring their own monitoring. Teams already running managed detection and response capability should confirm it covers extension behaviour and AI-agent action logs, not just endpoint file activity, and a broader zero trust posture should extend explicitly to agent-to-browser communication channels.

• •Audit and restrict extension permissions, especially broad 'read/change all data' grants
• •Patch browsers immediately given confirmed fixes for Chrome and Edge
• •Treat AI browser agents as privileged accounts requiring dedicated monitoring
• •Review agentic browser deployments (Comet, Neon, Claude) against vendor patch status before wider rollout

The bigger picture for agentic browsing

BragJack is unlikely to be an isolated finding. As vendors race to embed agents capable of acting across tabs and websites, the attack surface shifts from conventional malware detection toward abuse of legitimate software doing exactly what it was told. Organisations weighing wider AI agent adoption should read about other AI agent cyberattacks on infrastructure before finalising deployment policy, and should treat this disclosure as a prompt to review browser and extension governance across their estate via cyber security services rather than waiting for the next proof-of-concept.