Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

BragJack: PoC attack hijacks AI browser agents via malicious extension

Security researcher Gal Weizman of Forever Security demonstrated 'BragJack,' a proof-of-concept attack using a malicious browser extension and a 'Prompt Forcing' technique to hijack AI assistants built into Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The research earned over $20,000 in bug bounties and resulted in two CVEs.

Disclosed 19 September 2026 · Record updated 1 October 2026

Impact

A single malicious browser extension could hijack AI assistants across multiple major browsers using a prompt injection technique called Prompt Forcing.

Our coverage

Sources

  1. bleepingcomputer.comhttps://bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions