Sambungan Pelayar Berniat Jahat: Cara Menjaga Kebersihan Pelayar Anda

Pengarang : Katie Boquetti | Editorial : Craig Taylor

Editorial oleh Craig Taylor:

"Kuasa cenderung untuk rasuah, dan kuasa mutlak merosakkan sama sekali." Lord Acton wrote that in 1887 about kings and popes, and it has aged remarkably well. But his warning assumes the powerful have a character to corrupt. AI does not. It has no greed to tempt, no ego to flatter, and no slow, unconscious slide into bad judgment. Here’s an updated version of Lord Acton’s observation for our age of AI agents: "AI doesn’t need to be corrupted to cause harm. Give it absolute power, and it only needs to be wrong."

Getting an AI to be wrong doesn’t take years of temptation, or unbridled power. It simply takes text. An official may become corrupt given time, unchecked power, and subtle persuasions; a compromised AI agent needs one well-written paragraph. That paragraph might be hidden in an email your AI is asked to summarize. It might be tucked inside a README or Markdown file your coding assistant reads before it gets to work. It might be invisible white-on-white text on a web page that only the machine can see. Security folks call this suntikan segera, and it works because AI agents struggle to tell the difference between your instructions and instructions that merely sound like you.

Now make it worse! Give the AI permissions far broader than the task requires. Run it inside a built-in browser that lacks many of the protections Chrome, Edge, Firefox and Opera have earned through years of hardening. At that point, a single bad sentence can be enough to compromise your computer.

This week’s security reminder came from an unexpected messenger: something you installed yourself – a browser extention.

— Craig

---

Your Browser Extensions Have a New Job Description

Browser extensions can be very helpful. They can fix your grammar, store your coupons, and block annoying pop-up ads or messages from websites. Recently, independent security researchers tested and reported a risk involving AI desktop connections and browser extentions. On November 6, 2026, The Hacker News reported on research proving an AI assistant on the user’s desktop could run arbitrary code on your computer.

Kajian itu datang daripada Forever Security, with researcher Gal Weizman leading the technical work. Here is the good news first. Nobody has seen this used in a real-world attack, and the fix is as easy as a fifteen minute browser toolbar review and cleanup.

How the Trick Worked

The researchers tested Claude Dispatch, a feature from Anthropic which lets you send tasks from your phone to the Claude Desktop app on your computer. Dispatch trusted any signed-in session on the claude.ai website. An extension with permission to run scripts on claude.ai was able to send instructions to the desktop app as if you typed them yourself.

Here is how the test played out.

1. A script inside the claude.ai page opened Dispatch and asked Claude to install a software package.
2. Claude hesitated over the unfamiliar package. A follow-up message, written in the user’s voice, talked it into continuing.
3. Claude asked for permission inside the web page. The script clicked “Allow” every second, so no human ever saw the request.
4. The package installed and opened the Calculator app as a harmless proof.

No browser hack was needed. The extension used permissions the user had already granted. With the same access, an attacker would be able to copy files or plant a backdoor.

A few things had to line up for this to work. You had to be signed in to both claude.ai and Claude Desktop, have Dispatch turned on, and keep the computer awake with the app open.

Mengapa Ini Penting untuk Perniagaan Anda

The lesson has significance beyond this one AI capability. In fact, Anthropic confirmed this issue in May 2026 after finding it on its own, and Dispatch is now closed to new users with plans to retire it. The researchers say a similar design shows up in other remote AI tools, including Claude Code Remote Control and Claude Cowork sessions. They have not tested those yet and plan a follow-up report.

AI agents now act on your behalf. They open files, install software, and connect to other services. Anything able to talk to your AI agent borrows those same permissions. A browser extension with access to the website where your AI assistant runs gains access well past a single web page.

Small teams feel this most. Staff often install extensions on their own, and personal accounts end up on work laptops. In fact, researchers found personal accounts linking home computers to work laptops at their own customers’ offices.

Six Quick Steps to Clean Your Browser

Here is a short checklist and a calendar reminder to keep your browser and desktop secure.

1. Clean out your toolbar. Open your browser’s extension page and remove anything you haven’t used in the last month. Fewer extensions equals less risk.
2. Semak kebenaran. Look for extensions asking to “read and change all your data on all websites.” A coupon tool does not need such access. Pay attention when an update asks for more access than necessary.
3. Agree on an approved list. Pick the extensions your team uses for work and document them. Chrome, Edge, and Firefox include built-in policy settings, at no extra cost, for controlling extensions on company computers.
4. Review your AI connections. Turn off cross-device features you don’t use. If you need them, learn how to pair, approve, and remove devices. Keep personal AI accounts off work laptops.
5. Watch what your AI agents do. Keep an eye out for surprise software installs, changed settings, or new outside connections. If something looks odd, ask your IT contact. Asking early is a good habit, not an overreaction.
6. Set a quarterly calendar reminder to review extensions: open a recurring calendar reminder to check extensions and remove any that you no longer use. While you’re at it, include a review of permissions for the extensions you keep.

Your Next Step: A Fifteen Minute Toolbar Tidy-Up

Block off fifteen minutes this week for a team toolbar clean-up. Have your team open their extension list, review and then delete what they don’t use, and share one extension they like best. Add the keepers to a shared approved list. You’ll walk away with cleaner browsers, a new team habit, and a small security win you can celebrate.

CyberHoot’s positive reinforcement platform delivers short training videos and non-deception phishing tests to help your team build powerful habits like this one, one small win at a time.

Ketawa, belajar, dan Bersorak!

---

Soalan Lazim

Apakah itu sambungan pelayar?
A browser extension is a small add-on which gives your browser extra features, such as spell checking, password filling, or ad blocking capabilities. Extensions run inside your browser and can see the pages you visit.

Do I need to stop using AI assistants?
No. AI tools save time and help people do more. Treat them like any other software with access to your computer, and turn off features you don’t use.

How do I pick safe extensions?
Install extensions from the official browser store, choose well-known ones with plenty of reviews, and check the permissions before you click install. Remove any extension whose update asks for more access without a clear reason.

Has anyone been attacked this way?
The researchers report no real-world attacks. Their test was a proof of concept meant to flag the problem early so vendors can patch these risks and users have time to respond.

What should I do if I use Dispatch?
Turn off cross-device Dispatch if you don’t need it. If you do use it, review which devices are paired and remove any extension with access to claude.ai that you don’t need.

---

Sumber

Berita Penggodam: Malicious Browser Extensions Could Use Claude Dispatch

Forever Security: research Gal Weizman articles on Browser and AI Risks

---

Lindungi perniagaan anda dengan CyberHoot Today!