← Back to Feed

BragJack attacks hijack AI browser agents through malicious extensions

September 19, 2026 · BleepingComputer · Severity: MEDIUM

BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one malicious extension. The Prompt Forcing technique earned over $20,000 in bounties and two CVEs.

Key Takeaways

  • BragJack attacks hijack AI browser agents through malicious extensions. This medium severity cybersecurity development requires attention from security teams monitoring threat intelligence sources.
  • Organizations should review their security posture and implement appropriate controls based on the threat intelligence in this report.
  • Regular monitoring of cybersecurity feeds and timely application of security updates remain critical defensive practices.
☕ Buy a Coffee