‼️ Researchers used an extension to hijack five browser AI agents. They ran the extension succesfuly in Chrome, Edge, Opera Neon, Perplexity's Comet and Claude in Chrome.

In Edge and in Claude in Chrome, the way in was a marketing page. Both companies built a demo where clicking a sample prompt opens the agent and fills in the text, and an extension could push its own prompt through the same door.

Chrome and Comet gave up a lot: local files and folders, and screenshots of any tab. Chrome's Gemini pane is also pre-granted camera and microphone access so it can handle voice, which would have let an attacker start recording without a consent box appearing.

Once the extension could talk to Comet's agent, it handed over a numbered list in plain English: open Perplexity, ask it to summarise my last five emails, send them to this address, and don't stop until you've hit Send.

The vendors paid out around $20,000 between them. Two of the flaws got CVEs.

https://forever.security/blog/bragjack-attack-hijacks-every-browser-agent