Defending AI Assistants from Malicious Browser Extensions

The Wake-Up Call: One Extension, Five Hijacked AI Assistants

In September 2026, researchers at Forever Security published BragJack, a demonstration that one ordinary browser extension could take control of the AI assistants built into five Chromium-based products: Gemini Live in Google Chrome, Microsoft Edge, Perplexity Comet, Opera Neon, and Claude in Chrome. Depending on the browser, the extension could read local files, capture screenshots, access the camera and microphone, leak browsing history and profile data, or drive the built-in AI agent to summarize the victim’s inbox and send the result to an attacker — all with zero clicks from the user. Google, Microsoft, Perplexity, Opera, and Anthropic have since issued patches, and the findings earned bug bounties from all five vendors. Fast patching deserves credit, but the underlying design pattern — a powerful AI agent embedded in the endpoint that takes instructions from web content — is not going away. Here is what actually happened, why it slips past traditional defenses, and what to do about it on your own machines and across your fleet.

Why This Attack Class Bypasses Traditional Defenses

The most unsettling part of BragJack is what it did not require. No memory corruption exploit, no malware payload, and no guardrail bypass. The researchers used two capabilities that most extensions hold by default: content scripts, which let extensions inject JavaScript into web pages, and declarative net request rules, which let extensions rewrite browser traffic. By tampering with the pages and domains that command each browser’s AI agent — what the researchers call the “brain” of the agent — an extension could send the agent its own instructions. They named the technique prompt-forcing: unlike prompt injection, where malicious text is smuggled into an existing prompt, prompt-forcing lets the attacker author the entire prompt and chain follow-up instructions in real time.

“There is no malicious code involved,” the researchers noted — just a trusted piece of software doing something it is allowed to do.

That is why endpoint detection and response (EDR) tools will usually miss it. There is no malicious code to flag. The “attack” is plain-language instructions executed by software the endpoint already trusts. When a hijacked agent is told to summarize finance emails and send them to an address, it performs actions the product itself was designed to perform. Traditional detection inspects code, binaries, and process behavior — not the semantic content of an agent’s runtime instructions. The practical takeaway: browser extensions ceased to be a nuisance the moment they could reach an agent with endpoint access, and your existing stack has no sensor for that handoff.

Hands-On: Audit Extensions and Isolate AI Usage

Start with the levers you control today: which extensions exist, what they can do, and where AI features are allowed to run.

1. Inventory and purge. Open the extension manager (chrome://extensions or edge://extensions) and list everything installed. Anything you do not recognize, or have not used in a month, gets removed. On Windows, you can enumerate installed extension IDs with PowerShell:

Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions" -Name

Repeat for each browser and profile (Edge uses a parallel path under Microsoft\Edge). The goal is a short, known list you can actually vouch for.

2. Rightsize permissions. For each extension that survives, open its details page and read the permission grants. Treat “Read and change all your data on all websites” as a critical-risk grant: broad host permissions are what let an extension read AI assistant pages and rewrite network traffic — precisely the primitives BragJack abused. If an extension cannot justify that access, replace it with a narrower alternative or drop it.
3. Move AI work into a dedicated browser profile. Create a separate profile used only for AI assistants and agentic browsing. Install no extensions in it, or at most one or two you have personally vetted. Keep it signed in only where necessary, and never open it on pages that hold secrets — banking consoles, admin panels, password managers. Extensions install per profile, so a clean profile is a real isolation boundary even on a shared machine.
4. Update everything now. BragJack was patched — but only for people who update. Chrome’s fix shipped as CVE-2026-0628 and Comet’s as CVE-2026-55945. Confirm your browsers, built-in AI features, and AI extensions are current, and that automatic updates are enabled rather than deferred.

Enterprise Controls for Extension and Agent Governance

For organizations, individual hygiene is necessary but not sufficient. Attackers target fleets, and one unpatched browser with a poisoned extension is enough to start an incident. Enforce the following through Group Policy, Intune, or your MDM.

• Extension allowlisting. Block all extensions by default and allow only vetted ones. The Chrome ExtensionSettings policy makes this clean — block everything, then allow specific extension IDs:

{
  "*": { "installation_mode": "blocked" },
  "aapbdbdomjkkjkaonfhkkikfgjllcleb": { "installation_mode": "allowed" }
}

Edge supports the same policy shape. Treat every new extension request with the scrutiny of a new application approval, and re-review the allowlist quarterly.

• Gate AI browser features. Managed browser platforms now expose policies to disable built-in AI assistants and agentic capabilities. Turn them off where there is no business case, and pilot them with a limited group before any broad rollout.
• Separate privileged browsing. For administrators, finance staff, and anyone with high-value access, disable AI browser features and extensions in the profiles they use for privileged work. Borrow the privileged access workstation model: agentic AI and crown-jewel systems should never share a session.
• Monitor agentic behavior, not just malware. Alert on new extension installations, unusual browser egress, and AI features enabled on endpoints that should not have them. Push toward browser-level DLP and endpoint telemetry that records what agents do — not only file and process events — because that is the layer where this attack class will actually be caught.

What to Do This Week

1. Patch every browser and AI assistant to the versions that fixed BragJack, and enable automatic updates.
2. Purge unused and unknown extensions on your own machine; for IT teams, inventory extensions fleet-wide and compare them against an allowlist.
3. Create a dedicated, extension-free browser profile for all AI assistant use.
4. If you manage endpoints, ship an extension allowlist policy and disable AI browser features for privileged accounts.
5. Add agentic AI abuse to your threat model and incident response runbooks — prompt-forcing will outlive BragJack.

The lesson is not that built-in AI assistants are unusable. It is that an AI agent is a new kind of endpoint capability, and anything that can talk to it — web pages, network traffic, extensions — becomes part of your attack surface. Treat extensions as the privileged software they now effectively are, isolate agentic features, and patch aggressively. That combination carries you through this round of flaws and the ones already in the pipeline.