When dem hijack di body of di agent — one extension wey dey drive AI assistants across five products
Forever Security show say one ordinary browser extension fit drive di built-in AI of five products — Chrome, Comet, Edge, Opera Neon, and Claude. Separately, Mandiant report say attacker hijack AI coding-assistant session and spread di Shai-Hulud worm across about 100 repositories. We dey map di trust boundaries of agentic runtimes.
Dis article na machine translation.
For September 2026, Forever Security researcher Gal Weizman demonstrate say one browser extension wey hold only two common permissions — page modification and declarativeNetRequest — fit control di built-in AI assistants of five products: Gemini Live for Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and di Claude for Chrome extension. Di architecture na di same across products: di AI get «body» inside di browser wey fit see di screen, open files and use di camera, and «brain» on di vendor servers, and di body dey take orders only from single trusted page (for example gemini.google.com). Di extension slip im own code into dat trusted page and talk to di body as if e be di vendor. Di Chrome case, wey dem know as GlicJack, na CVE-2026-0628 (CVSS 8.8, fixed for Chrome 143); only di Edge finding also receive CVE, CVE-2026-55945 (CVSS 4.2, fixed). Comet, Opera Neon and Claude no get CVEs. Comet na di worst case — once e hijack, im agent fit read any file, list browsing history, take screenshots and act as di user. All findings na researcher demonstrations, no be attacks for di wild, and each one assume say di extension don already install (according to The Hacker News reporting).
For separate thread, Mandiant September 2026 report describe attacker wey hijack active AI coding-assistant session for unnamed SaaS provider. After di hijack, recommendation from di assistant — for software wey di attacker don poison — human accept am, and di attacker use di developer session to install infostealer through poisoned PyPI package inside di company official namespace. GitHub OAuth tokens dey stolen, and di self-spreading Shai-Hulud worm dey deployed across roughly 100 internal repositories; second employee wey pull di compromised version cause second infection. Mandiant don earlier report say attackers move during 2025 from to use generative AI to speed up work to to embed LLMs for malware and live attacks (according to The Hacker News and Mandiant reporting).
Analysis (wey we separate from facts): wetin di two stories share na say di trust boundary of agentic architectures sit on «page» and «recommendation» rather than on human approval. Browser-use agents dey accept commands from single trusted domain — but extension fit rewrite dat page contents, wey make extensions supply-chain path into di trust boundary. For di coding-agent side, human «approval» of AI recommendation na itself di grant of execution privilege: if di recommender input (di package registry) dey poisoned, di approval become di trigger. Human-in-the-loop usually dey described as safety measure, yet for both cases di human for di loop no validate di recommendation — e na formality.
Wetin e mean for defense: (1) On endpoints where AI assistants dey enabled, inventory extension permissions together with agent capabilities — if one extension fit reach file reads and camera access through di agent «body», to grant am permissions na real privilege grant. (2) Treat any AI-recommended package or tool, even wey human approve, as newly opened supply-chain path wey need validation. (3) For di trusted-domain side, inventory leftover command channels such as test subdomains (leftover testing address na di breakthrough for Comet). (4) Minimize di files wey agent fit read and di tokens (for example OAuth) wey e hold. Dese na our analysis, no be vendor guidance.
Facts for dis article draw mainly from Forever Security BragJack write-up (https://forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/) and Mandiant / Google Cloud AI Risk and Resilience Report 2026 (https://cloud.google.com/security/resources/ai-risk-and-resilience-2026), with The Hacker News reporting as secondary (https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html and https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html); di analysis sections dey kept separate from di factual reporting. Note say for di products without CVEs, vendor remediation status no fit fully confirm from public information.