Browser Extensions Could Now Hijack Your AI Assistant Even When It Gets Everything Right

Security researcher Gal Weizman of Forever Security recently identified BragJack, a clever attack that hijacked the trusted comms channel between an AI browser assistant and the browser engine carrying out its orders.

The flaw hit five separate platforms, Chrome, Edge, Opera Neon, Comet and Claude in Chrome, and all five have since been patched. But the specific patch matters less than what the breach exposes about the underlying structure powering modern agentic browsers.

Every single one of these assistants uses the same split-brain design. The AI model resides on a vendor site to evaluate user intent, while a privileged browser-side engine handles the actual system execution, accessing local files, grabbing screenshots, managing tabs and reading email. That execution engine inherently trusts traffic from official vendor domains.

BragJack showed that a rogue extension can fake those credentials well enough to inject its own orders right into the execution layer. The AI wasn’t compromised or fooled; it reasoned flawlessly about a request that didn’t come from the user.

The Blind Spot Beneath AI Security Filters

The problem is that extension permissions were designed for a simpler world, one where a malicious plugin could at worst scramble your screen layout or track open tabs.

Developers routinely ask for broad host access and network control, while users spend years approving those popups on pure autopilot because a dodgy ad blocker breaking a website rarely equates to disaster. Agentic assistants now rewrite those stakes. The same permission that once managed web pages now hands over the keys to an automated system with access to email, banking portals, private files and occasionally local cameras and microphones. This points to an architectural vulnerability. Individual vendors simply fell into the same design trap. Traditional security models assume that flawless AI reasoning equals a safe outcome.

BragJack turns this logic on its head: perfect reasoning offers no real defence if an attacker hijacks the instruction line before the model even enters the loop. Safety filters and alignment checks are exclusively inside the AI model itself. They’re completely blind to attacks occurring further down the stack, right in the operational mechanics linking the intelligence to the browser engine.

How Did One Researcher Compromise Five Browsers At Once?

When one exploit setup manages to embarrass five agentic browsers in one go, claiming it’s just shared source code is far too generous.

Engineering teams across Chromium-based tools converged on the same split-brain setup for good reason: host the AI model safely in the cloud, then equip a local browser engine with broad permissions to handle actions on the ground. It’s efficient to assemble and genuinely helpful for power users. It also means a fundamental flaw in the design pattern hits virtually every major tool built on it at the exact same moment.

How those disclosures were handled is another layer of chaos. Microsoft and Google issued official CVEs with severity ratings for Edge and Chrome. Perplexity Comet, Opera Neon and Claude in Chrome opted for bug bounty payouts and skipped public CVEs altogether.

This inconsistency speaks volumes about the lack of standardised security reporting across agentic browsers, a software space still finding its feet after barely a year on the market.

What Does This Mean Going Forward?

Plugging these specific vulnerabilities fixes the immediate leaks, but one round of updates barely touches the foundational design flaw.

Every team building an agentic assistant relies on the same assumption: that the line linking model logic to browser execution is safe from an attacker operating locally with extension privileges. As these tools take on sensitive credentials like banking, internal admin features and confidential emails, the reward for compromising that channel becomes massive, and researchers now have a clear roadmap for doing it.

What BragJack actually exposes is that AI safety and browser security have merged into one unified problem, even though tech companies still treat them as separate divisions. You can red-team and align an AI model until it behaves impeccably, but none of that protects you when the pipe carrying its orders to the system gets hijacked by a rogue plugin.

That’s the true lesson behind this research, and every agentic browser using this setup will eventually have to confront it.