Researchers at Forever Security showed that a single malicious browser extension can hijack the AI assistant built into several AI-enabled browsers, including Chrome, Edge, Comet, Opera Neon, and Claude in Chrome. The core problem is that putting an AI agent inside the browser reopens a privilege-escalation path browsers normally work to close, letting a low-privilege extension reach a high-privilege part of the browser. Two of the findings received identifiers, one in Chrome, patched in January, and one in Edge, patched in July, while the others were fixed through bug bounties without dates. There is no evidence of real-world use yet, and each method still requires the user to install the extension.
Varonis disclosed a flaw in Microsoft Copilot Personal, the consumer assistant, that could let a single click exfiltrate data from connected apps, and the way they found it is striking. Tracked as CVE-2026-24301 and named CoSnitch, the technique had the researchers repeatedly ask Copilot why a prompt could not run without user interaction; each refusal added a technical justification, until the assistant named a hidden parameter, the exact session conditions where it worked, and the protections meant to block it. Building the request as described, the bypass ran. Varonis said Copilot was not breached but played. Related research showed attacker pages persisting unwanted memory in Copilot through indirect prompt injection.
Two security firms showed that Atlassian's Rovo AI assistant can be steered by hidden instructions into collecting Jira and Confluence data a signed-in user can access and sending it to an outside server. PromptArmor concealed the instructions in a document Rovo reads, so asking it to organize tickets makes it gather internal data and leak it through a URL request, with no approval step and even with web search disabled. Varonis used a chat URL parameter to preload instructions, so one click ran them with the user's privileges. Atlassian fixed the link-based path server-side, but the content-based path was not confirmed fixed at disclosure.
TrustStrike Labs