When the Agent's Body Is Hijacked — One Extension Driving AI Assistants Across Five Products

In September 2026, Forever Security researcher Gal Weizman demonstrated that a single browser extension holding only two common permissions — page modification and declarativeNetRequest — could control the built-in AI assistants of five products: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and the Claude in Chrome extension. The architecture is the same across products: the AI has a "body" inside the browser that can see the screen, open files and use the camera, and a "brain" on the vendor's servers, and the body takes orders only from a single trusted page (e.g. gemini.google.com). The extension slips its own code into that trusted page and speaks to the body as if it were the vendor. The Chrome case, known as GlicJack, is CVE-2026-0628 (CVSS 8.8, fixed in Chrome 143); only the Edge finding also received a CVE, CVE-2026-55945 (CVSS 4.2, fixed). Comet, Opera Neon and Claude have no CVEs. Comet was the worst case — once hijacked, its agent could read any file, list browsing history, take screenshots and act as the user. All findings are researcher demonstrations, not attacks in the wild, and each assumes the extension is already installed (per The Hacker News reporting).

In a separate thread, Mandiant's September 2026 report describes an attacker hijacking an active AI coding-assistant session at an unnamed SaaS provider. After the hijack, a recommendation from the assistant — for software the attacker had poisoned — was accepted by the human, and the attacker used the developer's session to install an infostealer through a poisoned PyPI package inside the company's official namespace. GitHub OAuth tokens were stolen, and the self-spreading Shai-Hulud worm was deployed across roughly 100 internal repositories; a second employee pulling the compromised version caused a second infection. Mandiant had earlier reported that attackers moved during 2025 from using generative AI to speed up work to embedding LLMs in malware and live attacks (per The Hacker News and Mandiant reporting).

Analysis (separated from facts): what the two stories share is that the trust boundary of agentic architectures sits on a "page" and a "recommendation" rather than on human approval. Browser-use agents accept commands from a single trusted domain — but an extension can rewrite that page's contents, making extensions a supply-chain path into the trust boundary. On the coding-agent side, the human "approval" of an AI recommendation is itself the grant of execution privilege: if the recommender's input (the package registry) is poisoned, the approval becomes the trigger. Human-in-the-loop is usually described as a safety measure, yet in both cases the human in the loop did not validate the recommendation — it was a formality.

Defensive implications: (1) On endpoints where AI assistants are enabled, inventory extension permissions together with agent capabilities — if one extension can reach file reads and camera access through the agent's "body", granting it permissions is a real privilege grant. (2) Treat any AI-recommended package or tool, even human-approved, as a newly opened supply-chain path that needs validation. (3) On the trusted-domain side, inventory leftover command channels such as test subdomains (a leftover testing address was the breakthrough for Comet). (4) Minimize the files an agent can read and the tokens (e.g. OAuth) it holds. These are our analysis, not vendor guidance.

Facts in this article are drawn primarily from Forever Security's BragJack write-up (https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/) and Mandiant / Google Cloud's AI Risk and Resilience Report 2026 (https://cloud.google.com/security/resources/ai-risk-and-resilience-2026), with The Hacker News reporting as secondary (https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html and https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html); the analysis sections are kept separate from the factual reporting. Note that for the products without CVEs, vendor remediation status could not be fully confirmed from public information.