BragJack is a proof-of-concept attack that shows how a single malicious browser extension can hijack AI assistants built into Chromium-based browsers, Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude in Chrome. Once the extension is installed, it can run without further user interaction, abusing declarativeNetRequest (DNR) and content scripts to seize the trusted message channels between an AI “brain” (the model on a vendor site) and its “body” (privileged browser components). Instead of classic prompt injection, BragJack uses “prompt forcing,” where the extension feeds entire prompts and follow-up instructions directly into the agent’s control plane, so model guardrails never see the attack as untrusted content. In Chrome, this allowed code execution inside Gemini’s context, enabling local file reads, screenshots, and potential camera/mic access (CVE20260628). In Comet and Opera Neon, the agent could act on websites, summarize emails, and send data elsewhere. In Edge, a race condition between “Think” and “Do” modes (CVE202655945) let forced prompts execute as actions. Claude in Chrome was compromised via a trusted marketing page that could pass prompts to its side panel. No inthewild attacks are known, and vendors have patched the flaws and paid around $20,000 in bounties. However, these flaws emphasize the need to tightly control extension permissions, treat AI-agent activity as its own telemetry source, and design agents with strict origin validation, least privilege, and auditable command channels.