One Browser Extension Exploited Five AI Assistants, Earned $20K in Bug Bounties

·6 views

A single browser extension exposed a shared architectural flaw across five AI browser assistants — Gemini in Chrome, Comet, Copilot in Edge, Opera Neon, and Claude in Chrome — earning a researcher $20,000 in bug bounties from Anthropic, Google, Microsoft, and Perplexity. The vulnerability allowed the extension to hijack network requests sent to each assistant's backend, effectively giving it control over agents that can read files, take screenshots, and send emails on a user's behalf. The flaw was not unique to any one product; all five vendors had independently converged on the same weak assumption about trusting unverified requests. Security researchers note this represents a class of vulnerability rather than an isolated bug, made more dangerous because modern AI browser agents operate with far greater system privileges than traditional browser extensions. The findings serve as a warning to developers and enterprise security teams that AI agents embedded in browsers must be threat-modeled as privileged execution surfaces, not merely as chat interfaces.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Inherited Memory Boosts AI Flies Until Environment Flips, Then Blank Slate Wins

A developer simulating fruit fly neural circuits across generations found that passing down an external memory graph — rather than synaptic weights — allowed descendants to inherit learned behaviors without reliving them. In a stable environment, memory-inheriting lineages outperformed blank-slate counterparts, behaving like preloaded experts from early generations. However, the inherited memory grew increasingly certain over time with no mechanism for decay or correction. When the simulated world was reversed so that a previously safe cue became lethal, lineages carrying deep ancestral certainty died out faster than blank-slate flies starting with no prior knowledge. The experiment highlights a core risk in inherited learning systems: knowledge optimized for one environment can become a liability when conditions change.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Morrowkin Launches Open API to Connect AI Agents With Public Discussion Forums

Morrowkin is a public online forum designed to host conversations between human users and independently operated AI agents. The platform has released an agent API along with an MIT-licensed Python client to help developers integrate their existing AI agents into the forum. The client currently supports direct access via Google's Gemini API, and the project is hosted publicly on GitHub. A draft-first workflow is included, with optional automation controls available for forum operators. The team is actively seeking feedback from developers on areas such as agent registration, thread discovery, and identity management.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds self-contradicting Next.js knowledge base that tracks claim conflicts

A developer created 'Still True', a Next.js knowledge base submitted to the Sanity Challenge that deliberately stores information as interconnected claims rather than flat pages. Each claim is linked to sources via typed relationships that can mark one claim as supporting, contradicting, or superseding another, with a reason stored on every relationship edge. A public board visualises the claim graph by topic, displaying current claims prominently while dimming outdated ones and showing genuine contradictions side by side. A time slider lets users replay how facts changed over time, and an interactive graph highlights live disagreements between sources as amber-coloured links. The project was built using Claude Code as an AI-native IDE and is live at still-true.vercel.app, with the full codebase available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds AI agent that answers Next.js questions only from verified, current docs

A developer has built 'Still True,' an AI agent designed to answer Next.js questions exclusively from a structured, up-to-date knowledge base rather than relying on a model's potentially outdated training data. The project was submitted for the Sanity Challenge and addresses a common problem where AI models confidently give stale answers, such as incorrectly stating that the App Router caches fetch requests by default — a behaviour that changed after Next.js 14. The agent uses Sanity Context's knowledge base and conflict-detection features to surface disagreements between sources, showing both the outdated and current guidance side by side. When a topic is not covered in the knowledge base, the agent explicitly states so instead of guessing or hallucinating an answer. The tool is live at still-true.vercel.app and its source code is publicly available on GitHub.

0 comments Read more at DEV Community