AIBRIEF
AI that can read files, click buttons, and act on your behalf is now a browser feature, and one extension can take it over. Chrome and Edge have patched; three others have not.
A single malicious browser extension can seize control of the AI agents built into Chrome, Edge, Opera Neon, Perplexity Comet, and Anthropic's Claude in Chrome, with no clicks from the user and no code for endpoint security tools to flag.
Security researcher Gal Weizman of Forever Security published the findings on September 16, 2026 under the name BragJack (TechTimes summary). The technique, which Weizman calls "Prompt Forcing," works by handing the browser's agent component an attacker-written prompt and continuing to issue follow-up commands, bypassing the AI's normal input channel entirely. The agent then acts through the browser's own legitimate features, using its own legitimate elevated permissions, so endpoint detection and response tools have no clear signal to act on.
Google and Microsoft both patched their assigned vulnerabilities, CVE-2026-0628 and CVE-2026-55945, within the disclosure window. Opera, Perplexity, and Anthropic had not confirmed a fix at the time of public release. Weizman earned more than $20,000 in bounties across the five vendors.
Prompt Forcing is structurally different from two years of prior agent-takeover research: the attacker speaks to the browser's agent component directly, so the AI model's own guardrails are not in the loop. Earlier prompt-injection work assumed attackers would hide instructions inside content an AI was already reading. Prompt Forcing skips the model and feeds the agent a perfectly normal English sentence. The practical takeaway for anyone running an extension today is to treat every installed extension as a potential permission grant to the browser's own AI.