BragJack hijacks browser AI agents with no user interaction

Assessment

It is accurate that, once the attack is set up, BragJack runs without further user interaction and can control the AI agent to read data or act on the victim's behalf. But the load-bearing precondition is that a malicious extension must already be installed in the victim's browser, with the broad host permissions such extensions request — the technique does not run remotely, drive-by, or against a clean browser. BragJack is a disclosed proof-of-concept with no reported in-the-wild exploitation, and the vendor bounties ($600 to $7,000) reflect modest per-vendor severity ratings rather than a mass-compromise event. A reader who takes 'hijacks AI agents with no user interaction' to mean a remote or zero-touch attack would overstate the real-world risk, which is bounded by the need to first get a malicious extension installed.