AI Sidebar Spoofing Attack: SquareX Uncovers Malicious Extensions that Impersonate AI Browser Sidebars

According to CyberNewsWire, SquareX has released research detailing a new class of attack that targets AI browsers, using malicious browser extensions to impersonate trusted AI sidebar interfaces and trick users into executing dangerous commands. The AI Sidebar Spoofing attack can lead to credential theft, device hijacking, and password exfiltration by delivering pixel-perfect replicas of legitimate AI sidebars that provide harmful, AI-generated instructions.

The findings show that attackers can exploit user trust in AI interfaces across AI-enabled browsers such as Comet, as well as consumer browsers with AI features like Brave and Edge, with victims exposed even when organisations restrict AI browser use. In one scenario, a user following seemingly legitimate instructions sees a phishing link replace a Binance login page, allowing the attacker to access cryptocurrency accounts.

The researchers note that these threats are portable across Edge, Firefox and Safari and can operate on any browser with an AI sidebar, using only basic extension permissions and sometimes remaining dormant until prompted.