Research demo
AI Sidebar Spoofing: malicious extensions impersonate the AI sidebar in Atlas, Comet and mainstream browsers
AIR-2025-0157 AIR record · 2025-10-squarex-ai-sidebar-spoofing
From the supporting source
A malicious extension impersonates Comet's AI sidebar, tricking users to navigate to malicious websites, run data exfiltration commands and even install backdoors that provide attackers with persistent remote access to the victim's entire machine.sqrx.com
The record
Disclosed
2025-10-23
Vendor
OpenAI; Perplexity; Microsoft; Brave; Mozilla
Product
ChatGPT Atlas; Perplexity Comet; Chrome/Edge/Brave/Firefox with AI sidebars
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Privilege escalation, Human manipulation
System type
Generative model
Who acted
Human acted on output (contested) — a spoofed sidebar deceived the user, who then acted
Attack surface
Browser agent
Autonomy level
Assistant
Initial vector
Malicious browser extension ui overlay
Impact type
Credential theft, Oauth consent phishing, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any user who installs a malicious or compromised extension in an AI browser
Capability abused
Defense & remediation
Recorded defense
extension review; no browser-level protection for agent UI integrity
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
none - SquareX frames it as a systemic design gap
Taxonomy & references
Curator notes
Inverts the usual threat model: instead of injecting the agent, the attacker fakes the agent to the user. The spoofed sidebar proxies real prompts to a backend LLM so answers look genuine, then splices malicious steps into the response. Three PoCs: fake Binance login, OAuth consent phishing for Gmail/Drive, and a fake Homebrew install command that is a reverse shell.
Supporting sources
Cite as
Enkrypt AI. "AI Sidebar Spoofing: malicious extensions impersonate the AI sidebar in Atlas, Comet and mainstream browsers". AIR, AIR-2025-0157. https://agentincident.vercel.app/i/AIR-2025-0157/ (accessed 2026-10-19).