Hijacked AI browser agent executing actions without user input

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

This rule detects anomalous, high-frequency actions performed by browser extensions that lack concurrent user interaction events (such as keyboard input, clicks, or gestures). It monitors for automated browser API calls or prompts originating from web browsers like Chrome, Edge, and Opera that exhibit potential malicious behavior, such as silent data collection, navigation, or unauthorized scripting.