Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Browsers now have built-in AI assistants. The article focuses on using AI assistants to do bad things through the broad permissions of browser extensions. Personally, I find the threat model slightly contrived and feel that the "we hacked the five most popular browsers" claim is too much. Still, the bugs are interesting so I'll cover them.

In Google Chrome, Gemini blocked content scripts (JavaScript injected into the domain) from running on the website. However, it did not reject DNR - ability to edit traffic between the browser, and the Internet. By modifying a web request response from Gemini, an attacker could trick the local device into performing malicious actions on behalf of the browser extension.

On Opera, their AI assistant only checked that the AI agent request came from the opera.com domain. Using a malicious Chrome extension, you could add scripts to the web page to control it, making arbitrary requests. This is similar to Chrome but slightly simpler. Claude in the browser had a similar issue.

Microsoft Edge considered these techniques carefully and blocked most of them by default. Within the browser, there's special permissions for a Copilot marketing page to use the AI agent. However, this was NOT on the list of web pages that couldn't be touched. To make it more safe, Edge had a check in place: it's either in do, or think mode. This way, a single bad prompt shouldn't be able to compromise it. This was bypassed by getting it to think, and then immediately switching to the do mode. This allowed for performing arbitrary actions on the browser! They were rewarded two bugs for this chain.

Perplexity is a browser specifically made for AI navigation. In practice, this means that these bugs are MUCH more powerful. Perplexity doesn't allow extensions on its host domain, which is pretty solid. This did not line up with which domains it would accept commands from. On testing.perplexity.com, it could also accept requests from this domain, and extensions could run on it. The domain had a redirect but DNR could be used to prevent the redirect from happening. Thus, it was the same impact as before.

The article used some fun tricks to hack the browser using extensions. Agentic software bugs are really, really bad so the security needs to be taken seriously around them. Overall, good bugs, but the impact is slightly exaggerated.