> TritonInfoSec News
Home / Sep 21, 2026 / Story
0
#4 BleepingComputer general September 19, 2026 at 14:56 UTC

BragJack attacks hijack AI browser agents through malicious extensions

By Ax Sharma

AI Summary

Security researcher Gal Weizman of Forever Security demonstrated 'BragJack,' a proof-of-concept attack using a single malicious browser extension to hijack AI assistants embedded in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude. The 'Prompt Forcing' technique earned over $20,000 in bug bounties and resulted in two CVEs, highlighting systemic risk in browser-integrated AI agent architectures.

Read full article → https://www.bleepingcomputer.com/news/security/bra…

Relevance score: 80.0/100

# More from September 21

  1. 1
    An undercover Google analyst infiltrated a notorious supply-chain hacking gang Ars Technica Security
  2. 2
    Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up The Hacker News
  3. 3
    Researchers escape OpenAI Codex sandbox to run commands on host BleepingComputer
  4. 5
    Malicious npm packages evade install-script defenses at runtime BleepingComputer
  5. 6
    Calling viral AI actress Tilly Norwood? Agree to a face scan first BleepingComputer
  6. 7
    Identity Visibility in 2026: The Foundation of Identity Security The Hacker News
  7. 8
    TigerByte Cyber Emerges From Stealth With $3 Million in Funding SecurityWeek
  8. 9
    ‘Nudify’ apps: What to do if someone makes a fake nude of you WeLiveSecurity (ESET)
  9. 10
    Viral AI actress' hotline face-scans every caller, watches their mood BleepingComputer