BragJack: The Extension That Puppeteers Your AI Browser Agent Without Touching the Model

A single browser extension can now take the wheel of your AI assistant. Not by exploiting the model, but by exploiting what the model is allowed to touch.

On Saturday, September 19, security researcher Gal Weizman of Forever Security disclosed BragJack, a proof-of-concept attack that hijacks the AI assistants built into Google Chrome, Microsoft Edge, Perplexity Comet, Opera Neon, and Anthropic’s Claude in Chrome. Five products, two new CVEs, over $20,000 in combined bounties. The technique is uncomfortably simple, and this week’s patches fix the instances without touching the design problem underneath.

Brain and body

Weizman describes agentic browsers as two parts. The brain is the model: it processes instructions and decides what should happen. The body is a privileged browser component that carries out the work, reading tabs, taking screenshots, accessing local files, clicking on your behalf. The brain is hardened, sandboxed, and picked over by red teams. The body is old-fashioned software with powerful permissions, and it trusts the wrong things.

The attack needs one thing: a malicious extension already installed in the victim’s browser. After that, Weizman says the abuse runs without any user interaction. No click, no prompt, no fake login page.

The Chrome path

Chrome blocks extensions from touching its privileged AI component directly, and from injecting scripts into Google’s Gemini site. Fair enough. But Chromium’s declarativeNetRequest (DNR) API lets an extension rewrite how network requests behave, including changing response headers and redirecting resources. Weizman used DNR rules to intercept the requests made by the embedded Gemini web app, weakened its security headers, redirected a JavaScript file, and ran code inside the Gemini context. From there he was talking straight to Chrome’s privileged AI component, never going through Gemini’s normal request flow.

What that access buys: reading local files, reaching web content, taking screenshots, and possibly the camera and microphone. Chrome assigned the flaw CVE-2026-0628 and paid $7,000. Microsoft’s race condition got CVE-2026-55945. Both vendors have shipped fixes for their assigned issues.

Agentic browsers are worse

Reading is bad. Acting is worse. Perplexity Comet’s built-in agent ships as an extension that trusts several Perplexity domains, including a testing domain that never got the same protections as the main perplexity.ai site. Weizman removed the redirect to that domain with a DNR rule, loaded it, and injected a content script that could talk to the agent. His demo forced Comet to visit Perplexity, summarize the victim’s emails, and send the results to another address. Every step of that looks legitimate in the browser’s own logs, because the agent performed it with its real privileges.

Edge splits Copilot into “Think” and “Do” modes, which on paper stops the assistant from acting on arbitrary instructions. Weizman found a race condition that briefly disables the restriction while forcing a prompt, then re-enables the action capability before the agent re-checks its state. Opera Neon and Claude in Chrome fell to similar variants.

Prompt Forcing: the attack your EDR won’t name

Weizman calls the technique Prompt Forcing. Conventional prompt injection slips hidden instructions into content an AI is already reading. Prompt Forcing skips the subtlety: the attacker hands the agent an entire prompt plus follow-up instructions, and the agent translates them into real browser actions under its own authority.

For defenders, that distinction is the worrying part. There is no malicious binary to quarantine. The thing committing the intrusion is signed, first-party software doing exactly what it was built to do. Your endpoint stack sees a browser acting like a browser.

For African enterprises, the math is blunt. Our banks, our payment gateways, our merchants all live inside the browser. A fintech operations team that adopts an agentic assistant is handing out a privileged account with no credentials to steal and no login to phish. Our SIEM rules don’t have a clean pattern for it yet.

What to do this month

Patch first. Chrome and Edge fixes are shipping, so force the update rather than waiting for users to accept the restart prompt. Then audit installed extensions against a browser policy, not a suggestion. Anything with broad “read and change all your data on all websites” permissions is in scope, and if you don’t enforce extension allow-listing per machine, you don’t actually have extension control.

Treat agent deployment as privileged access. Decide what the agent may touch, who may point it at those things, and what it may send out. Then assume you’ll need to answer what it actually did, which means visibility on browser-side data movement, not just network edges.

At eHawu we’ve argued for a while that the modern breach lives in the gaps between endpoint controls and network controls. BragJack sits right in one of those gaps: a legitimate application, manipulated by a legitimate browser feature, moving data you never sanctioned. eHawu watches that data-in-motion layer and flags what doesn’t belong. The agents aren’t going away. Your blind spot around them can.