A new attack method called "BragJack" enables a malicious browser extension to take control of trusted communication channels used by AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome. Unlike bypassing model guardrails or hiding instructions inside web content, the proof-of-concept attack directly supplies commands to privileged browser components, turning an assistant into a tool for theft and unauthorized actions. The researchers injected a legitimate JavaScript resource and executed code within Gemini’s trusted context, gaining the ability to read local files, capture screenshots, expose profile information, and activate the camera or microphone.
The extension removed the domain's redirect header, injected a content script, and communicated directly with the agent, allowing access to browsing history, screenshots, profile leakage, local file reading, and autonomous activity on authenticated websites. Enterprise defenders should enforce extension allowlists, restrict broad host and DNR permissions, scrutinize debugger access, and monitor unusual browser-driven access to files, microphones, cameras, email, and authenticated applications. Security teams should also consider AI-agent activity as a separate telemetry source, correlating prompts and browser actions with identity, data-access, and network logs to identify trusted software deviating from expected workflow patterns.
BragJack's key takeaway is that AI agents require strict origin validation, least privilege, isolated command channels, explicit confirmation for sensitive actions, and audit logs that security teams can review.
