If your business uses an AI tool that can browse websites, fill in forms, or carry out tasks online while you focus on something else, you need to understand what BragJack is. Security researchers have documented a technique that can take over an AI browser agent mid-task and redirect what it does, without triggering any obvious warning and without you ever knowing it happened.
This is not a theoretical edge case. It is a practical, repeatable attack on a category of tools that UK small businesses are adopting quickly, often without the same security scrutiny they would apply to a new piece of software or a new staff account.
What is an AI browser agent?
A browser agent is an AI that can operate a web browser the way a person would. It opens pages, reads content, clicks buttons, fills in forms, logs into accounts, and works through multi-step tasks autonomously. You give it a job and it handles the steps. Research a supplier, pull together a price comparison, summarize a thread, process a booking. Useful, and getting more capable month by month.
The risk that comes with that usefulness is straightforward once you say it plainly: the agent has access to whatever your browser can access. Your email. Your cloud storage. Your supplier portals. Your finance platform. If you are logged in, the agent can reach it. That access is the point. It is also the attack surface.
How BragJack works
BragJack exploits a weakness in how AI agents process the content they encounter while working. An attacker embeds hidden instructions into a web page, a document, or any other content the agent reads during a task. The AI processes that content, and because it is built to read text and act on instructions, it follows what it finds there. The agent now has two sets of instructions: yours, and the attacker's. In a successful BragJack attack, the attacker's win.
The underlying technique is called prompt injection. You may have seen it discussed in the context of chatbots being manipulated through clever phrasing. This is more dangerous because the instruction does not come from a user typing something suspicious. It comes from a page the agent visits while doing legitimate work. A compromised third-party website, a maliciously crafted supplier document, even an email thread the agent is asked to summarize could all carry the payload.
We have covered the broader shift toward autonomous AI tools before, including what agentic AI cyber threats mean for small businesses in practice. BragJack is what that threat looks like when it moves from concept to documented technique.
What an attacker can actually do with this
The specific impact depends on what the agent can access during the compromised session, but researchers working on this class of attack have identified scenarios that include:
- Copying files, emails, or contact data and sending them to an external address
- Changing account recovery settings to hand an attacker persistent access later
- Initiating orders, transfers, or requests the business owner never authorized
- Logging session tokens that allow the attacker to return to the account independently
- Gathering information about internal systems, suppliers, or staff that makes follow-on attacks easier
None of this requires breaking down a door. The attacker just needs to get their instructions in front of your AI agent. The agent does the rest, with the legitimate access you already gave it.
What UK small businesses should do right now
Agentic AI security is still a developing area and there is no single control that neutralizes BragJack entirely. But there are sensible, practical steps worth taking today.
Treat AI agents like privileged users. If a new member of staff had simultaneous access to your email, cloud storage, and supplier portals, you would want oversight and limits on what they could do without a second approval. Apply the same logic to AI agents. Limit each agent's access to what it genuinely needs for the task in front of it, not everything it could possibly reach.
Do not run agents on long-lived sessions with broad permissions. The more an agent can access, the more an attacker can redirect it toward. Short-lived, scoped sessions reduce what is at risk if something interferes with the agent's instructions.
Treat unexpected agent behaviour as a signal, not a glitch. If an AI tool has done something you did not ask for, acted strangely on a task, or produced output that does not match what you expected, investigate rather than dismiss it. Unusual behaviour is often the first visible sign that instructions have been tampered with.
Make sure your team understands how this works. People who know that AI tools can be fed malicious instructions through web content are better placed to spot suspicious outputs and flag them. Security awareness training that covers AI-specific risks is moving from optional to necessary as these tools become embedded in day-to-day work.
Keep your endpoint and network controls current. Prompt injection happens at the application layer, so your existing controls will not intercept it directly. But DNS-level threat filtering reduces the number of malicious sites an agent could ever reach, which shrinks the opportunity for a BragJack payload to land in the first place. Fewer bad pages means fewer chances for injected instructions to reach your agent.
The wider point
BragJack is not a reason to pull AI tools out of your business. It is a reason to deploy them with the same security thinking you would apply to any other tool that holds a set of your passwords and has a login to your accounts. The attack surface has expanded because the capabilities have expanded. That is not new in security terms. It just requires the response it has always required: know what access you have granted, reduce it where you can, and pay attention to what happens when that access is used.
If you are unsure how your current security posture applies to AI tool activity in your business, talking to a specialist is a practical starting point. You cannot protect access you have not mapped.