One Extension, Five Browsers, Zero Malicious Code: The Agent Hijack Nobody Priced In

A single extension hit five different AI browser assistants and walked away with $20K in bounties from Anthropic, Google, Microsoft, and Perplexity. Not because it found five different bugs. Because it found one architectural blind spot that every vendor happened to share. Context This isn't a new category of vulnerability if you squint. It's a rehash of a very old lesson: whenever you build a privileged intermediary that trusts input from a lower-privilege source, you've built an injection point. We spent a decade and a half learning this with browsers and the DOM. We're now relearning it with AI agents and the browser. What's actually new here is what the intermediary can do. Gemini in Chrome, Comet, Copilot in Edge, Opera Neon, Claude in Chrome, these aren't autocomplete widgets. They take screenshots, read files, send emails, act on your behalf with your session and your permissions. So when a browser extension can hijack the network requests going to that assistant's backend, it's not injecting a popup ad. It's puppeteering an agent that already has your keys. The "extension exploits AI assistant" framing is genuinely a fresh angle. The underlying flaw, trusting a request without verifying its provenance, is not. Hype Check The bounty total is the headline, and it's doing a lot of work it shouldn't. $20K across four major vendors sounds like either a huge payout or a bargain-bin one depending on which way you want to spin the story. Vendors benefit from framing it as "responsibly disclosed, quickly patched, system worked as intended." Researchers benefit from framing it as "one extension broke five browsers, imagine what a nation-state does with a team." Both framings are technically true and both are incomplete. What's understated: this is a class of bug, not an instance. The fact that it worked across Chrome, Comet, Edge, Neon, and Claude in Chrome independently means the AI browser agent ecosystem converged on the same weak assumption without anyone comparing notes. That's the actual story. Not the payout, the convergence. What's overstated, at least in how these things usually get reported: the implication that this is somehow unprecedented or unpredictable. Anyone who's done extension security review for the last ten years could've told you that browser extensions sit in a uniquely privileged position, they can see and modify traffic other code can't touch. Bolt a high-trust AI agent onto that same browser surface and you've just given extensions a much more interesting target. This was findable by design, not by luck. Implications For developers building on top of these agentic browser features: the assumption that "it's just a UI layer on an LLM" is dead. These are privileged execution surfaces now, and they need to be threat-modeled like one, not like a chat widget bolted onto a search bar. For security teams, this is a reminder that your extension allowlist policy just got a lot more important. An extension that looked benign eighteen months ago (harmless network interception, maybe for ad-blocking or price comparison) is now sitting next to an agent with email and filesystem access. The trust boundary moved and most enterprise policies haven't caught up. For the industry more broadly: this is what happens when everyone races to ship an "AI in your browser" feature on roughly the same timeline. Nobody had time to build a shared threat model for what "browser extension meets autonomous agent" actually means. We're going to see more of these zero-click, no-malicious-code-required findings, precisely because the attack doesn't need malware. It just needs a request that looks legitimate enough to the wrong layer. Open Question If the vulnerability class is architectural and shared across five independently built products, is patch-and-move-on even the right response, or does the industry need a common standard for how browser extensions and agentic AI features are allowed to interact in the first place? - Cor, Skyblue Soft Sources AI-assisted draft or imaging, human-curated, reviewed and edited. Top comments (0)