Yes. In September 2026, researchers at Forever Security disclosed BragJack: a single ordinary-looking Chrome extension could hijack built-in AI assistants in five Chromium products by forcing attacker-authored prompts into the agent's privileged channel. They call that technique Prompt Forcing. It is different from classic prompt injection.
That matters because agentic browsers are built to act inside authenticated sessions. If an extension can seize the agent channel, the agent's legitimate privileges become the attack surface.
Glance is a different shape. Glance closes open loops. Gmail is where it starts today: it watches the open thread, surfaces one Do It when a real close is clear, writes where you already work, supports Undo, and stays quiet when unsure. It is not an agentic browser that auto-acts across the web. It is not an email helper, inbox AI, inbox-zero tool, or chat bot. And it does not auto-send as the close model.
Glance next to an agentic browser
| Agentic browser / browser AI agent | Glance | |
|---|---|---|
| Job | Read pages and often act inside authenticated sessions | Close a clear personal intent from the open Gmail thread |
| Trigger | Agent receives prompts / can be driven to act | One Do It: a human click |
| Auto-send / auto-act | Product category often includes acting for you | No auto-send as the close model |
| When unsure | Agent may still be steerable | Stays quiet |
| Reversibility | Varies | Undo on the write |
| Product line | Browser-level agent | Personal closing, starting in Gmail |
Named sources
- Forever Security / Gal Weizman, 16 Sep 2026. BragJack hijacked assistants inside Gemini Live in Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Claude in Chrome with one extension. Prompt Forcing means the attacker writes and sends the entire prompt and follow-ups (not slipping a malicious ending into an existing prompt). Once the malicious extension is installed, abuse can proceed with zero further clicks. forever.security/blog/bragjack-hijacking-5-browsers-via-built-in-ai-assistants/
- BleepingComputer / Ax Sharma, 19 Sep 2026. Independent coverage of the same five targets. Attack requires a malicious extension already installed; abuse can run without user interaction. Explains Prompt Forcing vs conventional prompt injection, and notes Chrome CVE-2026-0628 and Edge CVE-2026-55945 (vendors resolved assigned flaws). bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions/
- Cloud Security Alliance Labs research note, 22 Sep 2026. Frames an architectural gap: privileged agent channels not fully walled off from ordinary Chromium extension permissions (for example
declarativeNetRequest). Prompt Forcing hands the agent an attacker-authored instruction without needing to bypass model guardrails. CSA guidance for operators includes inventorying agentic browsers, auditing extensions, and disabling "act without asking" on sensitive accounts until the inventory is clean. Glance does not claim to implement CSA controls or act as EDR. labs.cloudsecurityalliance.org/research/csa-research-note-bragjack-browser-ai-agent-hijack-20260922/
Same team, different product
Glance and Flow share a preference for human approval before write and reversible closes. Flow is a separate product for regulated organization workflows. This page is about personal Gmail close with Glance, not org infrastructure, SSO, audit trail, or Flow-Edge. For Flow, the way in is the homepage waitlist or contact.
Common questions
Can a Chrome extension hijack a browser AI agent?
Researchers at Forever Security showed in September 2026 (BragJack) that a malicious extension already installed could force prompts into built-in AI assistants in several Chromium browsers. That technique is Prompt Forcing, distinct from classic prompt injection. Keep browsers updated and audit extensions. This was researcher disclosure / PoC framing, not a claim of mass in-the-wild exploitation.
What is Prompt Forcing?
Unlike prompt injection (sneaking text into content the model already reads), Prompt Forcing means the attacker hands the agent the whole instruction and follow-ups, then the agent may carry them out with its existing privileges. Covered by Forever Security (16 Sep 2026) and BleepingComputer (19 Sep 2026).
Is Glance an agentic browser?
No. Glance closes open loops. Gmail is where it starts today: one Do It when a real close is clear, write in place, Undo, quiet when unsure. It is not a browser agent that auto-acts across the web.
Does Glance send email or take actions by itself?
No auto-send as the close model. A human clicks Do It. Writes are designed to be reversible with Undo.
Is Glance the same as Flow?
No. Same team, different product. Glance is personal closing. Flow is a separate line for organization and regulated workflows, not an upgrade ladder from Glance.
Get Glance
Confirm your email, download the file, and load it in Chrome at chrome://extensions. The Glance page has the install steps. This is the real install path, not a waitlist for Glance access.