A single malicious browser extension can hijack AI assistants across five major browsers using a new attack technique called Prompt Forcing, according to research disclosed on September 19 by Gal Weizman of Forever Security. The proof-of-concept attack, named BragJack, compromises AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. Weizman earned over $20,000 in bug bounties and was assigned two CVE identifiers for the findings.
How BragJack Uses Prompt Forcing to Manipulate AI Assistant Behavior
BragJack employs a technique Weizman calls Prompt Forcing, which manipulates the prompts or instructions that AI browser assistants receive. AI assistants operating in browsers typically have access to the current page’s content, browsing history, and user context to provide relevant responses and perform actions on behalf of the user.
A malicious browser extension can intercept or modify the data stream between the browser and the AI assistant, injecting crafted prompts that alter the assistant’s behavior. For example, an attacker could force the AI to exfiltrate sensitive data from the page, manipulate assistant responses to mislead the user, or execute unintended actions using the assistant’s elevated permissions within the browser.
Why AI Browser Assistants Are High-Value Targets
AI browser assistants often have broad access to user data. They can read page content, access cookies, view form inputs, and in some cases interact with web APIs or cloud services on the user’s behalf. This access makes them attractive targets for attackers seeking to exfiltrate credentials, session tokens, or sensitive information displayed in the browser.
If an attacker gains control over an AI assistant’s behavior through Prompt Forcing, they effectively gain the assistant’s privileges. This includes the ability to read data the user has not explicitly shared, generate responses that appear to come from the legitimate assistant, and potentially trigger actions that the user did not authorize.
The attack is particularly dangerous because users trust AI assistants to act in their interest. A hijacked assistant can present malicious suggestions or data exfiltration as legitimate assistant behavior, making the attack difficult for users to detect.
BragJack Targets Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome
Weizman’s research demonstrates that a single malicious extension can compromise AI assistants across five different browsers and assistant implementations. The affected platforms are Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic’s Claude running in Chrome.
The fact that one extension can target multiple browsers and AI assistants suggests the vulnerability lies in a shared architectural pattern rather than in a single vendor’s implementation. Browser extensions have broad permissions to inspect and modify page content, inject scripts, and intercept network traffic. When AI assistants operate within the browser’s extension ecosystem, they inherit the same threat model as any other browser-based service.
Weizman Earns $20,000 in Bug Bounties and Two CVE Identifiers
Weizman reported the BragJack vulnerabilities through the affected vendors’ bug bounty programs. The research earned over $20,000 in bounty rewards and was assigned two CVE identifiers, indicating that the vendors acknowledged the findings as legitimate security vulnerabilities requiring remediation.
The assignment of CVE identifiers means the vulnerabilities are now part of the public vulnerability database. Organizations using the affected AI assistants should monitor vendor advisories for patch availability and apply updates as soon as they are released.
Vendor Response and Patch Expectations
Affected browser and AI assistant vendors are addressing the vulnerabilities disclosed in Weizman’s research. The exact timeline for patches varies by vendor, but the assignment of CVE identifiers and the payment of bug bounties indicate that vendors are treating the findings seriously.
Users should review installed browser extensions and remove any that are untrusted or unnecessary. Even extensions that appear benign can serve as vectors for Prompt Forcing attacks if they have permissions to modify page content or intercept data streams.
Broader Implications for AI Assistant Security Models
The BragJack research highlights a fundamental challenge in securing AI assistants that operate within browsers. Browsers are designed to allow extensions broad access to page content and user data, making it difficult to isolate AI assistants from malicious extensions.
One potential mitigation is to run AI assistants in isolated execution contexts that extensions cannot access. This would require browser vendors to create new security boundaries specifically for AI assistant interactions, preventing extensions from injecting or observing the prompts and responses exchanged between the user and the assistant.
Another approach is to limit the data AI assistants can access based on explicit user consent for each interaction. Rather than granting blanket access to page content and browsing history, assistants would request permission to access specific data on a case-by-case basis. This model reduces the impact of a successful Prompt Forcing attack because the hijacked assistant would still be constrained by the permissions the user granted.
User Recommendations Pending Vendor Patches
Until vendors release patches for the BragJack vulnerabilities, users should minimize the number of installed browser extensions, especially those with broad permissions to read and modify page content. Users should also be cautious about the data they share with AI browser assistants, recognizing that a compromised assistant could exfiltrate that data to an attacker.
Organizations deploying AI assistants in enterprise environments should evaluate whether browser-based assistants are appropriate for accessing sensitive internal data. In some cases, standalone AI tools that operate outside the browser’s extension ecosystem may offer better security isolation.
