aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, security researcher Gal Weizman discovered BragJack, a novel attack method that compromises agentic AI assistants built into popular browsers including Google Chrome with Gemini, Microsoft Edge with Copilot, Opera Neon, Perplexity Comet, and Claude in Chrome. The attack exploits architectural flaws in how these browsers handle communication between extensions and AI agents, allowing malicious extensions to hijack the AI's functionality without relying on traditional prompt injection techniques. Attackers can force the compromised AI agents to access sensitive information, execute unauthorized actions, take screenshots, access local files, activate cameras and microphones, and exfiltrate data from any authenticated websites. The vulnerabilities affected hundreds of millions of users and earned over $20,000 in bug bounties, with Google and Microsoft issuing CVEs CVE-2026-0628 and CVE-2026-55945 respectively.

This incident highlights the emerging security risks as AI agents become more integrated into everyday browser experiences and demonstrates the critical need for secure architectural design in agentic systems before widespread deployment.

Why This Matters Now

BragJack represents a new class of AI agent attacks that bypass traditional security measures as organizations rapidly adopt agentic AI systems. With browsers increasingly integrating AI assistants and enterprises deploying autonomous agents, understanding and defending against architectural flaws that enable AI hijacking is critical for preventing data exfiltration and unauthorized system access.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Unlike prompt injection which requires hiding malicious instructions in content that AI reads, BragJack directly hijacks the communication channel between browser extensions and AI agents, allowing attackers to send unlimited prompts without bypassing AI guardrails.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely constrain the BragJack attack's ability to exploit browser-based AI agent communications through network segmentation and controlled access paths. The attack's reach across authenticated sessions and external communications would be significantly reduced through east-west traffic controls and egress policy enforcement.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Network segmentation would likely limit the compromised browser extension's ability to communicate with backend AI services and reduce the attack surface available for exploitation.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Microsegmentation policies would likely constrain the attacker's ability to escalate privileges across different application contexts and limit access to AI agent privileged functions through workload isolation.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely restrict the compromised AI agent's ability to access multiple authenticated sessions and constrain lateral movement between different web services and applications.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Network visibility and control mechanisms would likely detect and constrain abnormal communication patterns between compromised AI agents and external command infrastructure, reducing persistent access capabilities.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress filtering and data loss prevention policies would likely constrain the volume and scope of sensitive data exfiltration by restricting outbound communications from compromised AI agents.

Impact (Mitigations)

Despite network controls, the attacker may still perform limited destructive operations within already compromised browser sessions, though the scope would likely be constrained to individual user contexts rather than enterprise-wide impact.

Impact at a Glance

Affected Business Functions

  • Web browsing security
  • AI-assisted productivity tools
  • Browser extension management
  • Data privacy controls
Operational Disruption

Estimated downtime: 1 days

Financial Impact

Estimated loss: N/A

Data Exposure

Sensitive information accessible through browser agents including email correspondence, authentication tokens, local files, camera and microphone access, and data from websites where users are authenticated. Potential for data exfiltration to attacker-controlled endpoints.

Recommended Actions

  • • Implement Cloud Native Security Fabric (CNSF) controls to provide real-time inspection and autonomous enforcement against agentic AI abuse and shadow AI risks
  • • Deploy egress security and policy enforcement to prevent unauthorized data exfiltration from compromised browser agents to external destinations
  • • Establish zero trust segmentation with identity-based policies to limit AI agent access to sensitive resources and implement least privilege principles
  • • Enable multicloud visibility and control with centralized policy management to detect anomalous interactions and suspicious automation patterns from browser agents
  • • Implement threat detection and anomaly response capabilities with baselining to identify compromised browser agent behavior and trigger incident response procedures

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image