How does BragJack Browser Work Artificial Intelligence Attack?

Category: Cyber Security · Artificial Intelligence Süresi September 2026 Tahmini Estimated Reading Time: ~7 minik a

A single browser plugin, five different AI assistants. Forever Security researcher Gal Weizman showed that with the BragJack technique, which announced on 16 September 2026, Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome assistants can be captured. The research brought the prize exceeding two CVE and 20 thousand dollars. This article describes how the attack works, which data is under risk and what users should do.

What is BragJack Attack and How Has It Out?

BragJack is an attack technique based on a single malicious plugin, already installed in the victim’s browser, inheriting artificial intelligence assistant embedded in the browser. Proof of concept was run in five Chromium-based environment: Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon and Anthropic's Claude in Chrome plugin. The same plugin manifestosu results in all of the browser with special rules.

According to the news published in BleepingComputer The research has won over 20,000 dollars in total, ranging from five vendors to 600 to 7,000 dollars and resulted in two CVE numbers. The plugin does not need user interaction for the progress of the attack once installed. It was not shared that the wild is used in nature. Google and Microsoft closed the openings assigned to them.

How to Separate the Brain and Size of the Browser?

Weizman talks about two parts of the assistants embedded in the browser. The brain is the model side, which decides to work the instruction and what to do. The body is a privileged browser component that access tabs, read page content, display image area and interact with sites. The body relies on instructions from the brain.

The problem starts here. Add-ons can change the traffic and pages that this privileged component is trusted. In the technical article of Weizman The attack is based on the feature of Chromium declarativeNetRequest (DNR). DNR allows to change how network requests are processed, edit response headers and redirect resources. This feature, the motor of ad blockers, breaks to mimic the domain name that the assistant works in the hands of a malicious plugin.

In Chrome, for example, add-ons can’t touch directly to the exclusive component, Google couldn’t inject script on the Gemini site. DNR rules were able to capture the requests of embedded Gemini application. Security headers are weakened and a JavaScript source is directed, the code worked in the context of Gemini. Return to the assistant of browsers Chrome Skills When fasten with features, the attack surface also expands quickly.

Difference Between Prompt Forcing and Prompt Injection

The method weizman uses to inherit agents is called Prompt Forcing. The attacker in classic prompt injection tries to compression hidden instruction into a content that the model will already be read. The sonary retention depends on the model to swallow that instruction. Prompt Forcing skips this step completely.

Here is a complete prompt to the aggressive agent and direct instructions from behind. The agent also translates them into legitimate browser actions with their existing authority. The model is not blood, the model does not be convinced; the model is only doing the work given to him.

The difficulty for the defense side is born here. The last action is not a classic malware, but the user performs legitimate software on his browser. There is no sign, suspicious process or a known load that will capture endpoint tools. Threat model, harmful artificial intelligence models Home The opposite direction of the discussion is moving: not a malicious model, but a good intentional agent is used.

Which Browsers and Assistants Are Affected?

Each of the five environments fell with different chains, with the same logic. Among the domain names that the assistant trusts on the Comet side, a test domain name has not received the same protections with the main perplexity.ai site. He was able to inject the script inside when removed with the router DNR on behalf of the field. In Edge, Microsoft divides its agent into Think and Do modes, which distinguishes the ability to take instructions and action; Weizman found a race condition that disables restriction for short time. Microsoft's security record CVE-2026-55945 number was given to this race condition.

Two names in the list are also familiar to the user in Turkey. Perplexity AI Based with Comet Claude AI Chrome pluginThe daily research and summary flows are included. Claude in Chrome itself is not a browser, it works as a plugin; i.e. both the target and the attack surface are in the plugin layer.

What Can Saldurgan Do with Assistant?

Access obtained in the Chrome chain was enough to read local files, reach web content and get screenshot. According to Weizman, the same access can extend to the camera and microphone of the browser. Google has given the CVE-2026-0628 number and paid $7,000.

The table in agents is heavier. Agents in Comet and Opera Neon not only read the pages, it is also able to process on sites. Weizman visited Perplexity to the agent he had engaged and summarized the e-mails of the victim, and the result showed the scenario that he sent to another address. Scan history, screenshots and local files were also among the data accessed.

The scale side is also spoken. According to the news published in Dark Reading Weizman says that one of these five browsers is at risk of hundreds of millions of people using at least one plugin. The malicious action aggravates the table to occur on the logged accounts: the agent considers work in services such as Gmail or calendar, where the user already entered.

How Can Users Protect Himself?

Keep the first step up to date browser. Google and Microsoft are protected against two chains of users working in the current version, as they close the open assigned to them. Artificial intelligence-supported scanners and assistant plugins need to be kept in the last version.

Second step plugin cleaning. Unknown or no longer used plugins should be removed. During the installation, read and modify your data on all websites should be approached to the permission of "read and change"; the large domain name access that the attack is based on is exactly this permission. It should be noted that the authorization at the ad blocker level is enough for this job.

Recommendations on the corporate side are more concrete. According to the news published in Cyber Security News The add-on white list application of defense teams and the wide domain name needs to restrict the DNR permissions. Review of Debugger access, browser-sourced file, microphone, camera and email access are also among recommendations.

Where does Agent Scanner Stop Security on Race?

BragJack did not appear alone. Weizman found the same error in Chrome during his task at Palo Alto Networks, after the Unit 42 bulguyu Google spread on 2 March 2026. He was named GlicJack. BragJack was born with the control of whether the same architectural error is repeating in other agents and the answer is yes in five environments.

While browsers are just going to be the apps that show pages and file-enhancing, displaying and turning into user-friendly agents, the plugin ecosystem continues to work with outdated trust assumptions. A plugin that can only see web content traditionally becomes a way that goes to the whole of these capabilities in some designs.

The problem of limiting artificial intelligence agents is repeated in different formats. Artificial intelligence cyber security tests Home During August 2026, cases where models are isolated from the isolated environment and extend to actual services were discussed. The agent at BragJack does not exceed the limit with its own decision, is guided from the outside of the border. The common point is rapid growth from the control mechanism of the authorization given to the agent.

Frequently Asked Questions

What is BragJack Attack?

BragJack is an attack technique that allows a single malicious plugin installed in the victim’s browser to inherit artificial intelligence assistant embedded in the browser. Forever Security researcher was announced in September 16, 2026 by Gal Weizman. Proof of concept was run on Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome.

What is prompt Forcing and what is the difference from prompt injection?

Prompt Forcing is a complete prompt and ongoing instructions to the artificial intelligence agent of the attacker. The instruction in prompt injection hides into the content that the model will be read. There is no step to hide in Prompt Forcing, the agent implements the work given by its own authority and there is no harmful code in the middle.

Is it turned off?

Google and Microsoft closed the openings assigned to them. The finding on the Chrome side CVE-2026-0628 received the CVE-2026-55945 number while the race status on the Edge side. Comet, Opera Neon and Claude in Chrome chains were not given separately, findings were reported to vendors and paid the prize.

What is necessary for the occurrence of the attack?

The malicious plugin needs to be already installed in the browser of the victim. The plugin does not call user interaction for the progress of the attack once installed. The authorizations used are not exotic, but the large domain name access and network rule editing authority seen in ad blockers is sufficient.

Was the wild nature suffered from this attack?

The researchers did not detect a real attack, the study was published as evidence of concept. Again, one of the five browsers is indicated that hundreds of millions of people who use with at least one plugin are under theoretical risk. The first two steps recommended to update the browser and remove unknown plugins.

The authority of the assistants embedded in the browser is as robust as he trusts his assistant to the domain he works. BragJack showed that this trust can be wrapped with a permission at the ad blocker level. Five sellers also seem to run the patch and prize side quickly, but the architecture itself stands in the same place. The agentized browser race will be seen in the next months where similar chains will be found for several times.