BragJack AI Browser Agent Hijack via Malicious Extensions

Technical Analysis

BragJack leverages a technique called Prompt Forcing, where a malicious browser extension injects crafted content into the DOM or page context that is subsequently ingested by the AI browser assistant as if it were legitimate user or page data, effectively performing an indirect prompt injection at the browser integration layer. Because the attack works across multiple independent AI-assistant implementations (Chrome's built-in AI, Edge Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome), it demonstrates a class-level architectural weakness in how browser-embedded agents parse and trust extension/page-supplied content rather than a single vendor bug. The PoC reportedly earned two CVEs and substantial bounty payouts, indicating vendors validated exploitability and are likely deploying input-sanitization or provenance-checking patches. No public malware sample or in-the-wild exploitation has been reported; this is a disclosed research attack intended to drive remediation. This directly and significantly impacts AI agent systems: any organization deploying browser-based AI agents for tool use, web browsing, or autonomous task execution is exposed to prompt injection that could lead to unauthorized actions, data exfiltration, or credential/API key theft performed by the hijacked agent on the user's behalf.

Affected Systems

AI browser assistants including Google Chrome's built-in AI features, Microsoft Edge Copilot, Opera Neon AI browser, Perplexity Comet browser, and Claude in Chrome extension; affects browser extension architecture that allows content injection into AI agent context/prompts

Indicators of Compromise

• No specific file hashes, IPs, or domains published (proof-of-concept research disclosure, not observed in-the-wild campaign)

Remediation Steps

1. 1

   Apply vendor patches

   Update Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome to the latest patched versions addressing the disclosed CVEs related to BragJack/Prompt Forcing.

2. 2

   Restrict extension installation

   Enforce enterprise policies limiting installation of browser extensions to a vetted allowlist, particularly on endpoints where AI browser agents are enabled.

3. 3

   Audit AI agent permissions

   Review and minimize the permissions and autonomous action scope granted to browser-based AI assistants, especially for actions involving credentials, payments, or sensitive data access.

4. 4

   Implement content provenance checks

   For organizations building or integrating browser AI agents, ensure strict separation and validation between trusted user instructions and untrusted page/extension-supplied content before it reaches the model context.

5. 5

   Monitor for anomalous agent behavior

   Deploy monitoring for unexpected AI agent actions (unauthorized form submissions, data exfiltration, navigation to unexpected domains) that could indicate prompt injection exploitation.