A new type of proof-of-concept attack called BragJack can compromise five agentic browser environments and steal secrets: Google Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome.
Gal Weizman, an agentic software and browser vulnerability researcher at Forever Security, discovered the attack, which he said garnered the firm more than $20,000 in bug bounties from the companies affected, according to a blog post published today.
Contrary to most AI-based attacks so far, BragJack didn’t require the researchers to bypass AI guardrails or even rely on prompt injection, where an attacker hides instructions in content that an AI agent is expected to read, Weizman wrote in the post.
“We discovered something worse,” he wrote, adding that “all the vulnerabilities we discovered shared the same critical design flaw.” That flaw involves how agentic browsers interact with extensions in such a way that attackers can hijack the communication channel completely and force prompts into the browser’s built-in agent, making it do whatever they choose, he explains to Dark Reading.
“They didn’t need to cleverly hide instructions in data the agent interacts with, hoping it would take the bait; they could just send one prompt after the other until the agent got convinced to do anything,” Weizman says in an email interview. “Remarkably, this attack was effective against five of the most popular agentic browsers in the world, making it more than just a single vulnerability instance, but a novel type of attack.”
Different Attacks on AI, Similar Architectural Flaw
Forever Security contacted the five companies affected by the attack: Google, Microsoft, Opera, Anthropic, and Perplexity. Each acknowledged that a vulnerability existed in each company’s individual technology and awarded a bug bounty ranging from as low as $600 from Anthropic to as much as $7,000 from Google. Google and Microsoft even issued CVEs for the flaws in their Chrome and Edge agentic browsers: CVE-2026-0628 and CVE-2026-55945, respectively. The issues have since been resolved.
The manifestation of BragJack in each browser was different, as each had a different vulnerability; however, the architectural problem exploited across browsers was the same. That is, each allowed a browser extension to cross a boundary that was supposed to separate an untrusted extension from a highly privileged AI agent. This means that any consumer who used any of the five browsers with at least one extension installed was at risk, amounting to hundreds of millions of users, according to Weizman.
In Google Chrome/Gemini, for example, Chrome blocked extensions from injecting scripts into Gemini’s page but did not prevent an extension from modifying the network requests used to load Gemini. The researchers used that gap to substitute JavaScript from their own site in a way that gave them control of the browser-side “body” of Gemini. This allowed them to take screenshots, access local files, and activate the camera and microphone, without user clicks, according to the post.
In another example, to implement BragJack in Microsoft Edge/Copilot, the researchers had to chain together two weaknesses because they faced stronger defenses, according to the post. First, they found a Microsoft marketing page with special privileges to send prompts to the browser agent. They then bypassed a network-level defense protecting that page via a race condition between Edge’s “Think” and “Do” modes and, by switching modes at the right moment, managed to get the agent to both accept their instructions and execute actions.
BragJack: Proof of AI Agent Cyber Danger
BragJack is relevant not only because it demonstrates yet another way attackers can manipulate AI agents, but it also demonstrates the very scenario that inspired separate dire warnings over the weekend from a former Anthropic employee and its current CEO to rein in AI development — “how dangerous overly powerful agents (like the ones living in browsers) can be in the wrong hands,” Weizman tells Dark Reading.
“The browser agents in this research agreed to do anything the attacking extension ordered them to, including accessing sensitive information (such as email correspondence), leaking it anywhere, and even performing destructive operations on any website the user is authenticated to,” he says.
For this reason, the industry should heed the aforementioned warnings and proceed with caution to develop agents with “built-in constraints that would prevent them from completing tasks that may cause leakage of data or changes to system state before they become available to the public,” Weizman says.
Take Defensive Action Now Against Browser Agent Hijacking
Organizations also should take immediate steps to defend against BragJack and other attacks that can occur if agentic browsers go rogue. In the immediate term, Weizman recommends that organizations keep every Chromium-based browser in the organization up to date and “remove any extension that the organization has not vetted and that is not well known and safe to use,” he says.
While the attacks can bypass current endpoint detection and response (EDR) systems, there are ways that a security operations center (SOC) can set up detections by observing past interactions with the AI providers of each agentic browser and identifying potentially affected endpoints, Weizman tells Dark Reading. Once it’s done this, the SOC “should export transcripts of interactions the browser agent had with its AI provider server and look for potentially suspicious behavior that may indicate a compromise,” he recommends.
Looking ahead, Weizman adds, organizations also should consider adopting next-gen EDR that intercepts operations made by agentic components on the endpoint and use enriched context and AI capabilities to distinguish safe operations from those that put the organization in danger.
