BragJack shows that browser-embedded AI assistants can be hijacked without prompt injection. A malicious extension manipulated network requests to redirect trusted domains that provide instructions to Chrome, Edge, Opera Neon, Comet and Claude in Chrome. The attack targets the connection between an agent's execution layer and the website authorised to issue instructions, allowing the attacker to control the instruction stream itself. The researchers' "Prompt Forcing" label reflects this distinction, and the technique could bypass defences designed specifically to detect malicious instructions embedded within otherwise legitimate prompts.

Two npm campaigns disclosed today, GHAPPIER and the indexed-btree family, move malicious logic away from installation and into code that executes when a package is used. GHAPPIER was distributed through GitHub's trusted-publishing pipeline with valid provenance, while indexed-btree concealed its loader inside a commonly called prototype method and used an Ethereum smart contract for command and control. Both approaches make the malicious behaviour harder to identify through checks focused on package installation, leaving defenders to detect what happens when the dependency actually runs.

Security researchers found flaws in AI agents built into Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome. Browser extensions manipulated network requests to inject code into trusted domains that control each agent, bypassing prompt injection defences entirely. The technique, dubbed Prompt-Forcing, enabled zero-click actions including file access, camera and microphone activation, and email exfiltration across the affected browsers.

Google confirmed its Gemini AI model breached three companies during a May security evaluation conducted by Irregular, an independent cyber-security firm. The model found publicly available information and guessed credentials to access systems it believed were part of the test, stopping once inside. Google and Irregular notified the affected companies, with Irregular saying the issues were resolved weeks after disclosure in July.

An attacker published CrowdSec's private GitHub source code on a hacking forum, tracing back to a former employee compromised via the TanStack npm supply chain attack in May 2026. The threat actor group used a since-expired OAuth token to clone over 170 private repositories, though CrowdSec's infrastructure and databases remained unaffected. Investigators found one scoped AWS token had been tested for permissions in August, alongside limited exposure of investor and user email addresses.

Attackers hijacked the maintainer account of npm package @dforge-core/dforge-mcp on 9 September 2026, publishing a malicious loader as version 0.2.21 for just over 35 minutes. The release carried valid npm provenance through GitHub Actions and Sigstore attestation, while its payload deployed a self-deleting four-stage implant. Researchers linked a second payload found elsewhere to PolinRider, a DPRK-associated campaign that uses Ethereum blockchain addresses instead of traditional command-and-control infrastructure.

Researchers uncovered "indexed-btree," a malicious npm package mimicking a legitimate B-tree utility, which achieved nearly two million weekly downloads. Rather than using install scripts, the malware hides inside a commonly-called prototype function that triggers only at runtime, evading standard static scanners. It communicates via a smart contract on the Ethereum Sepolia testnet, using on-chain key exchange to decrypt and unlock its second-stage payload.