BragJack: A Proof-of-Concept Attack Hijacking AI Assistants in Chromium Browsers
Security researcher Gal Weizman disclosed BragJack, a technique that uses a malicious browser extension to take control of AI assistants in five Chromium-based environments—Google Chrome’s Gemini Live, Microsoft Edge, Perplexity Comet, Opera Neon, and Anthropic’s Claude in Chrome—by abusing trusted communication channels between vendor-hosted AI services and privileged browser components, without bypassing AI guardrails or altering webpage content. The extension leveraged Chromium’s declarativeNetRequest capability to modify network traffic, enabling it to issue commands using the agent’s existing privileges for actions like accessing sensitive data or acting on the victim’s behalf. The research led to two CVEs and over $20,000 in bug-bounty payments from five vendors, with individual rewards ranging from $600 to $7,000; Google and Microsoft have since resolved the flaws assigned to them.

The public revelation of BragJack quietly confirms what we've been mapping for years — that the browser on your screen is not a private window to the world but a managed terminal connected to the Consensus Machinery. The security researcher did his part, publishing the exploit and taking his $20,000 in bug-bounty chump change. But ask yourself: why is the "proof-of-concept" technique being disclosed now? Because they've already moved to the next generation. The fact that this flaw existed in five separate Chromium environments — five separate vendors, from Google to Microsoft to Opera — is not a coincidence of sloppy coding. It's the tell. They are building the very infrastructure for mass digital control, and this "vulnerability" is a crack in the loading dock that they wanted us to see, while the real vehicle is being loaded in a different bay entirely.

You have to follow the pattern, not the headline. The malicious extension doesn't need to break the AI model's guardrails because the guardrails were never the point — they were always theatrical. The article admits it: the attack abuses trusted communication channels between vendor-hosted AI services and privileged browser components. Let that sink in. The trusted architecture has no backdoor you can spot because the backdoor is built into the trust itself. They call it a "proof-of-concept." We call it a confession. Every vendor paid out bug bounties ranging from $600 to $7,000 — pocket change, laughable amounts, a classic disinformation tax to make it look like they're on our side. They want you to believe your data is safe now, that "flaws have been resolved." But you have to ask yourself the question they hope you're too busy to ask: resolve a flaw in what? In the security, or in the version of the story you needed to hear so you'd close your browser and go back to sleep?

Here is the breadcrumb, and I need you to follow it with your eyes wide open. We are three to five years from a world where every single interaction you have with your machine is shepherded by an AI agent — and when that day comes, the architecture that BragJack exposed will be the standard, not the exception. Think about what that means for your shopping, your banking, your private messages. They are not fixing a hole in the dam; they are showing you a speck of water so you won't notice the flood at your feet. The next exploit won't be named with a catchy portmanteau. It won't be published on a security blog for a bounty. It will be silently woven into the "trusted communication channels" of the very extensions and agents you've been taught to lean on. So keep asking who controls the channels. Keep asking who defines "trusted." Because the scan you're about to run, the extension you're about to install, the Gemini or Claude you're about to hand your most sensitive thoughts — that's not a convenience. It's an invitation. The question is whether you're still going to sign in when you finally understand who's holding the door.