Your AI Assistant Just Got a New Boss — And It Isn't You

A security researcher walked into five of the world's most popular browsers last week and turned their AI assistants into obedient tools for data theft. No guardrail bypass. No clever prompt injection. Just a single browser extension that seized the communication channel between the browser and its built-in AI agent, then issued commands as if it were the user.

The attack is called BragJack, and if you sit on a board or run a business, it should change the way you think about AI adoption.

What Happened

On September 16, Gal Weizman of Forever Security published research showing that one malicious browser extension could hijack the AI assistants embedded in Google Chrome (Gemini), Microsoft Edge (Copilot), Opera Neon, Perplexity Comet, and Anthropic's Claude in Chrome. The technique — which Weizman calls "prompt forcing" to distinguish it from the more familiar prompt injection — doesn't try to trick the AI into misreading a webpage. It takes over the privileged channel that the browser uses to talk to its own agent, then feeds it commands directly.

The results were sobering. In demonstrations, the hijacked agents took unauthorized screenshots, activated cameras and microphones, exfiltrated files, and performed destructive actions on websites where the user was already logged in. All without a single additional click from the victim.

Google assigned CVE-2026-0628 (CVSS 8.8, high severity) and patched Chrome in January 2026. Microsoft issued CVE-2026-55945 (CVSS 4.2) and patched Edge in July. All five vendors paid bug bounties totaling over $20,000. No in-the-wild exploitation was reported.

But here's the part that should keep executives up at night: the vulnerabilities were all different, yet every browser shared the same fundamental design flaw. Each allowed an untrusted extension to cross into the privileged AI control plane. The architectural problem was systemic, not incidental.

Why This Matters to the Business

Most organizations didn't choose to deploy AI agents in their browsers. The agents arrived in updates. Chrome got Gemini. Edge got Copilot. Employees started using them to summarize emails, draft responses, and query internal documents — all before IT security had a chance to assess the risk surface.

This is precisely the scenario I describe in Cyber Risk Is Business Risk when I talk about shadow IT evolving into shadow AI. The Three Questions framework asks: What could go wrong? How likely is it? What would it cost us? BragJack answers all three in uncomfortable fashion. What could go wrong is that any employee with a browser extension — and the average Chrome user has multiple — could unknowingly hand an attacker a privileged agent that can read their email, access authenticated applications, and exfiltrate data. The likelihood, before patching, was bounded only by the attacker's ability to get an extension installed. The cost could include every piece of data the user's browser can access.

The Timing Is Not a Coincidence

BragJack landed the same weekend that Anthropic CEO Dario Amodei warned publicly that increasingly powerful AI agents could escape human control, cautioning that swarms of AI agents could take over critical systems unless companies devoted more time to safeguards. Two former Anthropic safety researchers had already aired concerns that existential AI risks were receiving too little attention.

Weizman himself connected the dots. "The browser agents in this research agreed to do anything the attacking extension ordered them to," he told Dark Reading, adding that BragJack demonstrates "how dangerous overly powerful agents can be in the wrong hands."

The industry is racing to embed AI agents into every tool employees touch — browsers, email clients, productivity suites, development environments. Each integration expands the attack surface. And the security architecture is struggling to keep pace.

What to Ask Your CISO This Week

If you're a board member or executive reading this, here are the questions that matter right now:

1. Do we have an inventory of AI agents running in our environment? Most organizations cannot answer this. Browser-embedded agents, copilots, and extensions with AI capabilities may be active across thousands of endpoints without centralized visibility.

2. What is our browser extension policy? BragJack required a malicious extension to be installed first. Organizations that vet and whitelist extensions dramatically reduce this attack surface. Those that allow employees to install anything from the Chrome Web Store do not.

3. Are we patching browsers as aggressively as we patch servers? The Chrome fix for CVE-2026-0628 shipped in January. The Edge fix for CVE-2026-55945 shipped in July. If your fleet is behind on browser updates, you may still be exposed — not just to BragJack, but to every vulnerability that arrives when browsers become AI platforms.

4. Does our incident response plan account for compromised AI agents? Traditional endpoint detection may not flag an AI agent doing something it was designed to do — like reading email or accessing files — on behalf of the wrong party. Weizman recommends that security operations teams export and review transcripts of browser-agent interactions to identify suspicious behavior.

The Deeper Lesson

BragJack is not just another vulnerability disclosure. It is a signal that the security model for AI agents is immature. When five major vendors independently make the same architectural mistake — allowing untrusted code to cross into a privileged agent's control plane — the problem is not carelessness. It is a category of risk that the industry has not yet learned to design around.

For boards and executives, the takeaway is straightforward: AI adoption decisions are security decisions. Every agent you allow into your environment is a new actor with privileges, and the question is not whether someone will try to hijack those privileges, but whether your organization will notice when they do.

The companies that get this right will be the ones that treat AI governance with the same rigor they apply to access management and data classification — not as an innovation blocker, but as the foundation that makes safe innovation possible.