Security researcher Gal Weizman disclosed BragJack on September 16, 2026, demonstrating that a malicious browser extension could hijack AI assistants in five browser products without user interaction.