Browser-based AI agents are moving from passive assistants into software that can read pages, inspect browser context, and act on behalf of a user. That creates a useful productivity layer, but it also creates a new trust boundary: if the browser gives an AI assistant privileged access, every extension and web component that can influence that assistant becomes part of the attack surface.

A new proof-of-concept attack called BragJack, reported by BleepingComputer and detailed by Forever Security researcher Gal Weizman, shows how a malicious browser extension can abuse that boundary. The research demonstrated attacks against several AI-enabled browser environments, including Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The affected vendors awarded bug bounties, and Google and Microsoft assigned CVEs for specific issues.

What happened

The important point is not that an attacker found another bad extension. The important point is what the extension could reach once installed. Traditional browser-extension risk usually centers on reading web pages, stealing session data, injecting scripts, or redirecting traffic. BragJack shows that when AI assistants are wired into the browser with higher-level privileges, extension abuse can become a bridge into the assistant itself.

According to the reporting, the attack used normal extension capabilities such as content scripts and Chromium's declarative network request controls. In some cases, the extension could manipulate the traffic or trusted web context used by the AI assistant. From there, the attacker could influence the assistant or the browser component that performs actions for the assistant.

Why it matters

This changes the defender's mental model. If an AI browser agent can summarize email, access tabs, inspect files, capture screenshots, or perform authenticated actions, then compromise of the control path to that agent can turn a low-friction extension install into a higher-impact endpoint event.

For small businesses and government contractors, this is especially relevant because browser extensions often bypass the procurement discipline applied to installed desktop software. A team may block unsigned executables while still allowing employees to install productivity extensions with broad permissions. AI agents make that gap more expensive.

Defensive takeaways

  • Inventory extensions like endpoint software. Track which extensions are installed, who approved them, and what permissions they request.
  • Block broad permissions by default. Treat "read and change all data on all websites" as a privileged access request, not a convenience prompt.
  • Use browser management policies. Chrome, Edge, and other enterprise browsers support allowlists, blocklists, extension pinning, and forced removal.
  • Separate AI-agent pilots from production identities. Do not let experimental AI browsers or assistants run under accounts with unrestricted mailbox, file, cloud, or finance-system access.
  • Watch for unusual browser-agent behavior. Unexpected page visits, automated email access, suspicious downloads, new extensions, or changes to extension policy should trigger review.
  • Patch quickly, but do not stop there. Vendor fixes help, but this class of issue is also about governance: which agents are allowed, what they can access, and how extensions are controlled.

Bulwark Black assessment

AI browser agents are becoming endpoint automation platforms. That means they need the same controls defenders already apply to remote management tools, macro execution, and privileged scripts: least privilege, change control, logging, and rapid revocation. The safe default is simple: if an assistant can act with the user's identity, anything that can steer the assistant should be treated as sensitive.

Organizations do not need to ban every AI browser feature to reduce risk. They do need to stop treating browser extensions as harmless add-ons. Extension allowlisting, managed browser configuration, conditional access, and limited AI-agent scope are practical controls that can be deployed before this research turns into commodity tradecraft.

Sources: BleepingComputer; Forever Security research.