A new type of proof-of-concept attack called BragJack can compromise five agentic browser environments and steal secrets: Google Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome.
Gal Weizman, an agentic software and browser vulnerability researcher at Forever Security, discovered the attack, which he said garnered the firm more than $20,000 in bug bounties from the companies affected, according to a blog post published today.
Contrary to most AI-based attacks so far, BragJack didn't require the researchers to bypass AI guardrails or even rely on prompt injection, where an attacker hides instructions in content that an AI agent is expected to read, Weizman wrote in the post.
"We discovered something worse," he wrote, adding that "all the vulnerabilities we discovered shared the same critical design flaw." That flaw involves how agentic browsers interact with extensions in such a way that attackers can hijack the communication channel completely and force prompts into the browser's built-in agent, making it do whatever they choose, he explains to Dark Reading.