{
 "public_id": "AIR-2025-0157",
 "incident_id": "2025-10-squarex-ai-sidebar-spoofing",
 "date_disclosed": "2025-10-23",
 "date_occurred": null,
 "title": "AI Sidebar Spoofing: malicious extensions impersonate the AI sidebar in Atlas, Comet and mainstream browsers",
 "class": "research_demo",
 "attack_surface": "browser_agent",
 "initial_vector": "malicious_browser_extension_ui_overlay",
 "agent_capability_abused": [
  "agent_ui_trust",
  "instruction_following_by_the_user"
 ],
 "target_product": "ChatGPT Atlas; Perplexity Comet; Chrome/Edge/Brave/Firefox with AI sidebars",
 "target_vendor": "OpenAI; Perplexity; Microsoft; Brave; Mozilla",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "credential_theft",
  "oauth_consent_phishing",
  "remote_code_execution"
 ],
 "blast_radius": "any user who installs a malicious or compromised extension in an AI browser",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI05",
   "ASI03",
   "ASI09"
  ],
  "mitre_atlas": [],
  "labels": [
   "ui_spoofing",
   "clickjacking_adjacent",
   "extension_permission_model",
   "consent_phishing",
   "reverse_shell"
  ]
 },
 "defense_present": "extension review; no browser-level protection for agent UI integrity",
 "defense_bypassed": true,
 "fix_shipped": "none - SquareX frames it as a systemic design gap",
 "primary_sources": [
  "https://sqrx.com/ai-sidebar-spoofing"
 ],
 "verified_quote": "A malicious extension impersonates Comet's AI sidebar, tricking users to navigate to malicious websites, run data exfiltration commands and even install backdoors that provide attackers with persistent remote access to the victim's entire machine.",
 "confidence": "high",
 "notes": "Inverts the usual threat model: instead of injecting the agent, the attacker fakes the agent to the user. The spoofed sidebar proxies real prompts to a backend LLM so answers look genuine, then splices malicious steps into the response. Three PoCs: fake Binance login, OAuth consent phishing for Gmail/Drive, and a fake Homebrew install command that is a reverse shell.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Credential & Secret Theft",
  "Remote Code Execution & Sandbox Escape",
  "Persistence & Covert C2"
 ],
 "ai_entity": "generative",
 "agency": "human_acted_on_output",
 "agency_debatable": true,
 "agency_reason": "a spoofed sidebar deceived the user, who then acted",
 "vector_family": "malicious_component",
 "vector_detail": "malicious_browser_extension_ui_overlay",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "perplexity_comet",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "credential_theft",
  "privilege_escalation",
  "human_manipulation"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [
  "ASI04"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI04 | added ASI05 (impact=code_exec), ASI03 (signal=identity), ASI09 (agency=human_acted_on_output + reliance signal)",
 "submitted_by": "EAI Internal"
}