BragJack PoC Hijacks AI Browser Agents via Extensions

Security researcher Gal Weizman at Forever Security published a proof-of-concept attack on September 19, 2026, showing that a single malicious browser extension can hijack AI assistants running inside modern browsers. The technique is called BragJack.

Demonstrated targets include Chrome (with Google’s AI assistant and Claude in Chrome), Microsoft Edge (Copilot), Opera Neon, and Perplexity Comet.

What BragJack does

Browser extensions run at elevated privilege inside the browser. They can read page content, intercept network requests, inject scripts, and modify what the user sees. AI browser agents, now shipping as standard features in major browsers, operate inside the same trust model and are exposed to the same extension surface.

BragJack loads a malicious extension that intercepts communication between the AI agent and the browser. The extension can read what the AI agent processes, alter the inputs it receives, and redirect its actions, effectively placing an attacker in the loop between the user’s intent and what the AI actually does.

No specific vulnerability in any AI model is required. The attack abuses the browser’s own extension permission model.

Who is at risk

This is a PoC. No confirmed use of BragJack or equivalent techniques against real targets has been reported as of the publication date.

The practical exposure breaks down this way: users who install extensions from unofficial sources and run AI browser assistants in the same browser profile face the clearest risk. So do organizations rolling out AI browser agents, such as Copilot in managed Edge deployments, without governing which extensions employees can install.

The attack surface is expanding. Browser-integrated AI tools have shipped rapidly across major vendors, and the security model governing how they interact with extensions remains undefined.

What to do

There’s no vendor patch to deploy. This is a design-level gap in how browsers partition extension privilege from AI agent access. As of September 20, 2026, no browser vendor has published a formal response.

What you can do:

Audit extension permissions in any environment where AI browser agents are deployed. Extensions with “read all site data” access can interact with everything the AI agent touches. Revoke permissions that aren’t needed.

In Chrome and Edge enterprise deployments, Group Policy can restrict extension installation to an approved allowlist. If you haven’t done that and you’re running Copilot or any other AI browser agent across your fleet, it’s worth doing now.

For individual users, the advice is the same as it has always been for extensions: install fewer, vet them before granting broad permissions, and treat your installed extension set as part of your browser’s attack surface.

Previously covered: a Claude for Chrome trust boundary flaw that let other extensions read Gmail data, and Belgium eID extension bugs that enabled remote code execution.

Priority: low for most consumers (requires installing a malicious extension), medium for enterprises deploying AI browser agents without extension governance in place.