Summary
- Researcher Gal Weizman of Forever Security developed BragJack, a proof-of-concept attack that uses one malicious browser extension to hijack AI assistants across five platforms.
- The technique, called Prompt Forcing, manipulates AI browser agents into executing attacker-controlled instructions.
- The research earned more than $20,000 in bug bounty payouts and resulted in two CVEs.
- Affected platforms include Chrome, Edge, Opera Neon, Perplexity Comet, and Claude running in Chrome.
- No corroborating sources are available beyond the primary BleepingComputer report.
What BragJack Does
BragJack is a proof-of-concept attack developed by Gal Weizman of Forever Security. At its core, the technique uses a single malicious browser extension to interfere with AI assistants integrated into popular browsers and AI-native applications. The affected platforms identified in the research include Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic’s Claude when accessed through Chrome.
The Prompt Forcing Technique
The mechanism Weizman employed is called Prompt Forcing. Rather than attacking the underlying AI model directly, the technique works at the browser layer, using the extension to inject or redirect instructions that the AI agent then acts upon. In effect, the attacker’s extension assumes control of what the AI assistant is told to do, substituting legitimate user or application prompts with attacker-crafted ones. The result is that an AI agent — ostensibly acting on behalf of a user — can be redirected to serve an attacker’s objectives.
Recognition and Disclosure
The research attracted meaningful recognition from the security community and affected vendors. Weizman’s Prompt Forcing work earned over $20,000 in bug bounty payouts and resulted in two CVEs being assigned. The specifics of those CVE identifiers, the vendors who issued them, and any patch or mitigation timelines are not detailed in the available source material.
Scope of Exposure
The breadth of affected platforms is notable. Chrome and Edge together account for a substantial share of enterprise browser deployments globally. Opera Neon and Perplexity Comet represent newer, AI-integrated browsing experiences that are beginning to appear in personal and professional contexts. Claude’s inclusion points to the risks that arise when AI assistants are accessed through browser extensions in shared or unmanaged environments. The common thread is that AI agents operating within browsers inherit the extension attack surface that security teams have long managed — but the consequences of a compromised AI agent are qualitatively different from those of a compromised standard browser session.
Limitations of This Report
It is worth noting that this article is based on a single primary source, with no corroborating reporting available at time of publication. Technical detail on the precise mechanics of BragJack, the specific CVEs, vendor responses, and any available patches has not been independently confirmed. Security teams should monitor vendor advisories from Google, Microsoft, Opera, Perplexity, and Anthropic directly for further guidance.
Why it matters
AI browser agents are being introduced into enterprise environments with the same extension-based architecture that has always been a weak point in browser security. BragJack demonstrates that this attack surface is not theoretical: a single malicious extension can redirect AI agent behaviour across multiple platforms simultaneously. For CISOs, the risk is compounded by the fact that AI agents are increasingly trusted to take consequential actions — browsing, summarising, drafting, and in some implementations, transacting — on behalf of users. An agent that has been prompt-forced may carry out attacker instructions while appearing to the user to behave normally. This is not primarily a model-security problem; it is an endpoint and extension governance problem that sits squarely within existing security remit.
What to do now
- Audit and restrict browser extensions permitted in managed enterprise environments, applying allowlisting where feasible.
- Review policies governing the use of AI-integrated browsers such as Edge Copilot, Opera Neon, and Perplexity Comet on corporate devices and networks.
- Monitor advisories from Google, Microsoft, Opera, Perplexity, and Anthropic for CVE disclosures and patches related to this research.
- Assess whether AI browser agents in your environment have access to sensitive data or the ability to take privileged actions, and apply least-privilege principles accordingly.
- Include AI agent hijacking scenarios in threat modelling exercises for browser-based productivity tools.
