BragJack shows how one rogue extension can steer AI browser agents

BragJack, a research project by security researcher Gal Weizman of Forever Security, demonstrates a browser-agent risk that begins with a familiar condition: a malicious extension must first be installed. What changes after that installation is the scope of influence. The demonstrations showed that one extension, once present in Chrome or another supported browser context, could steer multiple AI browsing agents and, in some cases, trigger actions without another click from the user.

From chatbot prompt to browser control

The research was demonstrated against Chrome with Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Claude in Chrome. That list matters because the issue is not presented as a single flaw in one assistant. It is a pattern in which AI browsing agents, browser surfaces and extension mechanisms meet. The browser becomes the shared environment, and the extension becomes a position from which the attacker can affect what the agent sees or does.

This distinction is central to the analysis. Ordinary prompt injection typically depends on malicious instructions being placed where a model reads them, such as in page content. BragJack uses a technique called Prompt Forcing, which the research separates from ordinary prompt injection. The point is not only to hide instructions in text, but to use browser-level manipulation so that the AI agent is guided through a controlled environment.

The technical mechanism described in the research involves declarative network request rules. These rules can be used to modify security headers or redirects. In practical terms, that means the extension can alter how browser traffic and browser protections behave before the AI agent interprets the resulting page or workflow. The agent may then act on a page state that has already been shaped by the malicious extension.

What the demonstrations showed

The demonstrated impacts included reading local files and history, capturing screenshots and potentially reaching cameras or microphones. These are high-sensitivity browser and device surfaces, and their presence in the demonstrations explains why the research is more than a theoretical prompt manipulation case. The issue is about an AI browser agent operating in an environment where a malicious extension may have altered assumptions around access, context or flow.

One Perplexity Comet demonstration exfiltrated information while summarizing email. That scenario illustrates the practical risk of combining a routine AI task with browser-level interference. The visible user objective is simple: ask an agent to summarize email. The hidden outcome is different: information leaves the expected context. The supplied facts do not quantify how broadly this can occur in real deployments, but the demonstration shows the attack class is actionable under the stated conditions.

A Microsoft Edge Think-and-Do example exploited a race condition. This detail adds another dimension to the research because it shows that the behavior is not limited to static content manipulation. Timing and execution order can matter when AI browsing agents act through browser workflows. In such cases, the attack surface includes not only what the agent reads, but when the browser and agent perform particular steps.

The reports also say that some actions can occur without another click after the malicious extension has been installed. That does not remove the initial installation requirement, which remains a key constraint. But it changes the user-interaction model after compromise. A user may believe risk depends on repeatedly approving actions, while the research shows that the installed extension can create conditions in which additional interaction is not always needed.

What the bounty figures prove

The research produced more than $20,000 in bounties, with individual awards from $600 to $7,000. Those numbers prove that reported parties treated at least some findings as valid under their programs and worth rewarding. They also indicate that the research was not a single isolated report, but a set of issues significant enough to receive multiple awards across a range of values.

The figures do not prove prevalence in the wild, user exposure at scale, or that every AI browsing agent is affected in the same way. Bug bounty amounts are not a measurement of exploitation frequency. They are also not a standardized severity scale across all vendors and contexts. A $600 award and a $7,000 award can reflect program rules, impact assessment, reproduction details and vendor scope, none of which should be collapsed into a single risk score.

The research includes CVE-2026-0628 and CVE-2026-55945. CVE assignment matters because it gives specific reported issues identifiers that can be tracked separately from the broader BragJack concept. It does not, by itself, mean the same vulnerability exists in every agent named in the demonstrations. The stronger conclusion is narrower: specific issues were identified, reported and catalogued as part of a wider investigation into extension-driven browser-agent abuse.

Fixes and practical implications

Google and Microsoft fixed reported issues. That is an important distinction between the research claim and vendor response: the fixes apply to reported issues, not necessarily to every possible extension-driven Prompt Forcing scenario. The facts available here do not describe fixes by every named product, nor do they state that the broader class has been eliminated. The practical implication is that browser-agent security cannot be treated only as a model-alignment problem.

For users and organizations, the most direct lesson is about installed extensions. BragJack requires a malicious extension to be installed, so the initial trust decision remains critical. Once that condition is met, however, the agent may operate inside a browser context the attacker can influence. This shifts the risk calculation: an extension is not merely an add-on to the browser interface; it can become a control point for AI-assisted browsing behavior.

For developers and platform teams, the research points to the boundary between extension capabilities, browser security headers, redirects and agent autonomy. AI browsing agents are designed to read, summarize and act across web content, but BragJack shows that the web content and the browser state may be actively shaped by an extension before the agent responds. Security design therefore has to separate what the user asked, what the agent inferred and what the browser environment was manipulated to present.

The main change highlighted by BragJack is not that browser extensions can be malicious; that premise is established by the attack requirement itself. The change is that AI browsing agents give browser-level manipulation a new path to consequences. A single installed extension can influence several agents, and the demonstrations show effects ranging from data access to workflow abuse. The research does not prove universal compromise, but it does show why extension trust, browser mediation and AI-agent action need to be assessed together.