BragJack demo hijacks AI browser agents via one extension

A single malicious browser extension can hijack the AI assistants built into five major browsers, according to research published on 19 September 2026 and reported by BleepingComputer.

The proof-of-concept attack, named BragJack, comes from Gal Weizman of Forever Security. BleepingComputer reports that it hijacks the AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet and Claude in Chrome, using one extension to reach all of them. The technique at the centre of the work is called Prompt Forcing.

According to the report, the research earned Weizman more than $20,000 in bug bounty payments and resulted in two CVEs, the public identifiers assigned to confirmed security flaws. That suggests at least some of the affected vendors accepted the findings and treated them as genuine defects rather than expected behaviour.

BragJack is a demonstration rather than an attack seen in the wild. BleepingComputer describes it as a proof-of-concept, and there is no indication in the report that real users were targeted. The practical requirement is also significant: the attack starts with a malicious extension, so a victim would first have to install the offending add-on.

The targets are notable because they span the current crop of agentic browsers and browser assistants. These are AI features that can read the page a user is on and, in some configurations, act on their behalf. That combination is what makes hijacking attractive to an attacker. An assistant that can be made to follow instructions it was never meant to receive inherits whatever access the user has in the browser.

Prompt injection, where text that the model reads is treated as an instruction to follow, is the underlying class of problem here. BragJack's Prompt Forcing technique falls into that category. The source does not set out the mechanics of Prompt Forcing in detail, nor does it say which two CVEs were issued, which vendors paid the bounties, or whether every affected browser has shipped a fix.

The list of vendors involved covers Google, Microsoft, Opera, Perplexity and Anthropic. None of their responses are detailed in the report beyond the bounty payments and CVE assignments.

For users, the immediate takeaway is conventional: browser extensions carry broad privileges, and an AI assistant sitting inside the same browser expands what a hostile extension can reach. For vendors, the research is another data point in an accumulating pattern. Assistants that read untrusted content and then take action have repeatedly proved hard to isolate from that content, and BragJack shows the problem is not confined to one product or one company.