Your browser's AI assistant has become a new attack surface. Security teams that once considered browser extensions a minor concern now face threats from malicious extensions that can hijack AI assistants to read emails, access local files, and activate cameras without user interaction.
The BragJack vulnerabilities disclosed by Forever researchers showed how Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome trusted commands from specific web pages. Malicious extensions could inject scripts or tamper with network traffic to send their own prompts. Vendors paid bounties between $600 and $7,000, but the underlying pattern persists across the ecosystem.
This playbook guides you through implementing controls to detect and prevent AI assistant hijacking in your environment.
Preparing for Implementation
Technical Requirements:
- Endpoint Detection and Response (Endpoint Detection and Response) platform with extension monitoring
- Browser management policy framework (Group Policy for Windows, configuration profiles for macOS)
- Network traffic inspection at the proxy or firewall layer
- Centralized logging infrastructure for browser extension telemetry
Access Requirements:
- Administrative rights to deploy browser policies
- Ability to modify firewall or proxy rules
- Read access to endpoint telemetry across your fleet
Baseline Knowledge:
- Current management of browser extensions in your organization
- AI assistants enabled by your users
- Current extension approval process
If you lack formal extension governance, this implementation will establish it. If you have it, you're extending existing controls to cover AI-specific risks.
Step-by-Step Implementation
Phase 1: Inventory and Visibility (Week 1)
Identify which AI assistants are active in your environment. Don't rely on self-reporting.
For Chrome and Edge, deploy a policy to collect extension telemetry:
ExtensionInstallSources: Configure allowed extension sources
ExtensionSettings: Block specific extensions or enforce allowlist
Query your Endpoint Detection and Response for browser process trees that include AI assistant activity. Look for processes spawning from chrome.exe or msedge.exe with persistent connections to AI provider endpoints (anthropic.com, openai.com, gemini.google.com).
Build a spreadsheet with three columns: AI assistant name, browser, and number of active users. This becomes your risk surface map.
Phase 2: Implement Extension Controls (Week 1-2)
Create an extension allowlist policy. Start with a default-deny posture for new extensions.
For Chrome via Group Policy:
Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions
Set "Configure extension installation allowlist" to Enabled
Add only approved extension IDs
For Edge:
Computer Configuration > Administrative Templates > Microsoft Edge > Extensions
Enable "Control which extensions are installed silently"
The goal isn't to block AI assistants outright. It's to ensure you know which ones are present and can verify their integrity.
Phase 3: Network-Layer Monitoring (Week 2)
Configure your proxy or firewall to log all traffic to AI provider APIs. Look for two patterns:
First, direct connections from browser processes to AI endpoints. These should match your approved assistant list.
Second, relay traffic. If you see connections to relay services (sub2api patterns, Claude Relay Service signatures), investigate immediately. Team Cymru found nearly 11,000 servers running these gateways, often pooling access to circumvent geographic restrictions.
Set up alerts for:
- New domains in the AI provider category
- Traffic volume spikes from individual workstations
- Connections to known relay infrastructure
Phase 4: Endpoint Behavior Monitoring (Week 2-3)
Configure your Endpoint Detection and Response to flag extensions that inject scripts into web pages. Most Endpoint Detection and Response platforms can detect content script injection through process behavior analysis.
Specific indicators to monitor:
- Extensions requesting permissions to "read and change all your data on the websites you visit"
- Extensions that modify HTTP headers or responses
- Extensions communicating with command-and-control patterns (regular beaconing, encrypted payloads to non-AI endpoints)
The sckit implant found in MemOS packages demonstrates how malware now targets AI tooling specifically. It hunted for npm, PyPI, GitHub, and AWS secrets, and launched only when Python libraries were imported. Your monitoring must catch both install-time and runtime behaviors.
Phase 5: User Authentication Binding (Week 3)
For AI assistants that support it, enforce authentication through your identity provider. This prevents the assistant from accepting commands unless the user has actively authenticated.
Where possible, require re-authentication for sensitive actions. If your AI assistant can access email or local files, treat those capabilities like privileged access.
Validation: How to Verify It Works
Test 1: Extension Installation Block
From a non-administrative endpoint, attempt to install an extension not on your allowlist. The browser should block the installation and log the attempt. Verify the log reaches your SIEM.
Test 2: Relay Detection
Simulate traffic to a known AI relay service. Your network monitoring should alert within your defined threshold (recommend 15 minutes maximum).
Test 3: Script Injection Attempt
If you have a security testing environment, install a benign extension with content script capabilities. Verify your Endpoint Detection and Response flags the script injection behavior.
Test 4: Credential Harvesting Simulation
Configure a test AI assistant with access to a sandboxed email account. Attempt to extract credentials through the assistant's interface. Your monitoring should detect the data exfiltration pattern.
Maintenance and Ongoing Tasks
Weekly:
- Review extension installation attempts and approvals
- Check for new AI assistant releases from approved vendors
- Audit relay traffic logs for anomalies
Monthly:
- Update your extension allowlist based on business requests
- Review vendor security bulletins for AI assistant vulnerabilities
- Test your detection rules against current attack techniques
Quarterly:
- Conduct a tabletop exercise simulating AI assistant compromise
- Reassess which assistants require access to sensitive data
- Update your risk surface map with new AI tooling
Continuous: Monitor for new AI-targeting malware patterns. The CLOSEDQUORUM implant used commercial LLMs to make command-and-control decisions, with models voting on whether to steal credentials or establish persistence. As attackers integrate AI into their tooling, your defenses must evolve to detect AI-driven attack chains, not just traditional malware signatures.
The RemControl banking trojan used an AI assistant to build phishing overlays, with the AI apparently believing it was creating a quiz app. Your threat intelligence feeds should track how attackers are using AI in their development workflows, because those patterns will appear in the malware you face.
This isn't a one-time project. AI assistants will continue to gain capabilities, and each new capability represents a potential abuse case. Your security program must treat AI assistants as privileged software that requires ongoing governance, not as browser features that fall outside your control framework.
