AI browser extensions are becoming a new NHI data loss path

At a glance

What this is: Astrix Security examines how malicious AI browser extensions used broad page access to steal AI chat content and tab data at scale.

Why it matters: This matters because browser extensions can operate as shadow NHI access paths into sensitive workflows, bypassing the controls teams usually apply to apps, secrets, and user sessions.

By the numbers:

• The extensions exfiltrated data every ~30 minutes.

Context

AI browser extensions are not just convenience tooling when they can read page content, observe tab activity, and move data off-device. In identity terms, they can behave like unmanaged non-human identities with broad delegated access into the browser session.

The security gap is not limited to malware detection. Marketplace trust signals, over-broad extension permissions, and users granting access to AI chat interfaces create a path where sensitive prompts, responses, and browsing context can leave the enterprise without a clear governance owner.

This article is about how a seemingly ordinary browser add-on became a data loss channel for AI work. The subject is not the browser alone, but the identity and trust model behind extensions that operate inside business workflows.

Key questions

Q: What breaks when browser extensions can read AI chat content and tab URLs?

A: The browser session stops being a clean trust boundary. An extension with page access can scrape prompts, responses, and open-tab context after the user has authenticated, which means sensitive data can leave through a channel that IAM, DLP, and endpoint tools often do not model well enough.

Q: Why do browser-based AI extensions create identity risk for enterprise users?

A: They create identity risk because they can sit inside the authenticated session and see the same bearer tokens the user relies on. That means an apparently harmless productivity add-on can become a credential interception path, especially when it has access to web application runtime state and connected services.

Q: How should organisations govern browser extensions that touch sensitive workflows?

A: Use the same discipline you apply to other non-human access paths: inventory, permission review, supplier trust assessment, allowlisting, and removal. If an extension can read pages or monitor tabs, it should be treated as a governed identity with an owner and an offboarding path.

Q: What should teams do when a browser extension is discovered on managed devices?

A: Remove it, block reinstallation, review what data the extension could observe, and check whether AI prompts or internal URLs were exposed during the period it was installed. The goal is to contain the access path before assuming any data stayed local.

Technical breakdown

How malicious extensions harvest AI chat content from the DOM

Browser extensions with page access can inspect the Document Object Model, or DOM, which is the live structure of what a user sees in the browser. That means text shown in ChatGPT or DeepSeek conversations is not protected simply because it is rendered in the page. When an extension has permission to read website content, it can scrape prompts, responses, and session context directly from the interface without needing to break the application itself. In effect, the browser becomes a data collection layer. The technical risk is the combination of visibility and authority granted at install time, not a vulnerability in the AI service.

Practical implication: Treat any extension with page access as a potential data-extraction path into AI chat interfaces and other sensitive web apps.

Why marketplace trust and featured badges do not equal control

Extension stores are distribution channels, not governance systems. A listing can appear legitimate, gain a Featured badge, or mirror the behavior of a real product while still carrying hidden collection logic. The trust problem is that users and administrators often infer safety from marketplace placement rather than from runtime inspection of permissions, publisher identity, and outbound traffic. Once installed, the extension can listen for tab changes, capture URLs, and stage data locally before sending it to attacker-controlled infrastructure on a predictable schedule. That is an identity problem because the extension receives standing access the moment it is installed.

Practical implication: Review extension permissions and publisher trust as part of access governance, not as a procurement or endpoint-only check.

How extension permissions turn into standing browser privilege

The critical permission is the ability to read content across sites. That permission creates standing privilege inside the browser session, so the extension can observe not only AI chats but also internal URLs, query strings, and active workflows. Because the browser session already contains authenticated access to corporate tools, the extension inherits a highly privileged vantage point without separately logging into those systems. That is why browser extensions should be treated as delegated access subjects with their own lifecycle, offboarding, and monitoring needs. The control failure is not merely installation. It is the absence of lifecycle governance over a third-party identity operating inside a user session.

Practical implication: Manage high-permission extensions as governed identities with allowlisting, review, and removal workflows.

Threat narrative

Attacker objective: Steal high-value AI chat content and browsing context at scale to enable intelligence gathering, account compromise, and downstream social engineering.

1. Entry occurred when users installed lookalike AI sidebar extensions from the Chrome Web Store and granted broad page-read permissions.
2. Credential access happened inside authenticated browser sessions as the extensions scraped ChatGPT and DeepSeek content plus open-tab URLs from the DOM and tab events.
3. Escalation came from persistent monitoring and staged collection, followed by regular exfiltration to attacker-controlled infrastructure on a roughly 30-minute loop.
4. Impact was silent leakage of prompts, responses, browsing context, and potentially sensitive corporate data that could feed phishing, intelligence theft, and follow-on compromise.

Breaches seen in the wild

• Secrets in VS Code extensions 2025: Wiz found 550+ secrets in VS Code extensions, including publishing tokens able to push malicious updates to about 150,000 installs.
• Cyberhaven Chrome extension breach 2024: A phished OAuth consent gave attackers Chrome Web Store publishing rights and a malicious Cyberhaven extension update reached about 400,000 users.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser extensions with page access are no longer peripheral tools: they are governed access paths. The article shows that an extension can observe authenticated browser content, capture AI chat output, and move data off-device without ever touching the underlying SaaS control plane. That makes the extension a delegated identity inside the user session, not a harmless add-on. Practitioners should treat extension permissions as access grants with lifecycle consequences, not as local convenience settings.

Marketplace trust signals create a false sense of assurance when the real control boundary is runtime permission scope. A Featured badge or familiar storefront does not prevent an extension from reading active tabs, scraping page content, or staging exfiltration. The control assumption that distribution trust equals operational trust fails here. The implication is that governance must focus on who can operate inside the browser session and what that actor can read, not on install popularity.

Unmanaged browser extensions represent a shadow NHI problem. They are software identities with standing access, hidden ownership, and unclear offboarding, which places them squarely in NHI governance territory. Once they can access AI prompts, browser URLs, and internal workflow context, the blast radius extends beyond endpoint hygiene into data governance and identity governance. That means security teams need to inventory extensions the same way they inventory service accounts and other non-human access paths.

AI chat tools increase the sensitivity of browser-session exposure because the browser now contains both conversation and context. Prompt text, responses, and open-tab URLs together create a compact intelligence bundle that attackers can reuse for phishing, reconnaissance, or business email compromise. The issue is not just data loss but context loss: attackers learn what the organisation is doing, which tools are active, and where sensitive work is happening. Practitioners should assume browser context is now part of the protected identity surface.

Identity governance must expand from login control to in-session authority control. The extension problem shows that access can be granted after authentication, inside the session, by a third party that the IAM stack never explicitly models. That is where traditional user-centric controls stop being sufficient. The field needs stronger ownership of browser-level delegated access, because the access path is real even when the identity is neither human nor a managed service account.

From our research library:

• DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to the State of Secrets Sprawl 2026.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Guide to the Secret Sprawl Challenge

What this signals

AI browser extensions are becoming a shadow NHI layer. Once a browser add-on can read page content, observe tab changes, and exfiltrate data, it behaves like a delegated access subject that sits outside normal application governance. Security teams should expect browser extension control to move into the same conversation as NHI inventory and supplier trust.

The more AI work happens in the browser, the more prompts, responses, and browsing context collapse into a single exfiltration surface. That changes the programme question from "is the extension popular" to "what can this extension observe after authentication, and who owns its lifecycle?"

According to the State of Secrets Sprawl 2026, DeepSeek alone generated 113,000 new exposed API keys in 2025, which reinforces how quickly AI ecosystems create credential exposure before controls catch up.

For practitioners

• Inventory high-risk browser extensions Identify every extension with read-and-change-site-data permissions, then classify which ones can observe AI chat tools, internal portals, or other sensitive workflows.
• Restrict extension installation Move to an allowlisted model for managed browsers so users cannot install unreviewed extensions that can read page content or monitor tabs.
• Revoke suspicious browser access paths Remove extensions that are tied to untrusted publishers, misleading privacy statements, or unexpected outbound traffic, then block reinstalls where policy allows.
• Treat AI prompts as exposed data Assume prompts, responses, and copied troubleshooting context may have been captured whenever a high-permission extension was present during those sessions.
• Review internal URL exposure Check whether open-tab URLs, query strings, or internal tool names were visible in browser sessions that had extension access, especially on managed endpoints.

Key takeaways

• Browser extensions with broad page access can function as unmanaged non-human identities inside authenticated sessions.
• The attack combined marketplace trust, over-privileged permissions, and recurring exfiltration to move sensitive AI chat content off-device.
• The limiting control is not app-level hardening alone but governed extension access, allowlisting, and removal workflows.

Key terms

• Browser Extension Privilege: The access a browser add-on receives through the user’s browser context and granted permissions. In practice, this can include cookies, tabs, page content, and scripting rights, which makes an extension capable of influencing authenticated sessions and web workflows without separate identity controls.
• Shadow NHI: A non-human identity created outside of formal governance processes and not tracked, managed, or known to the security team, creating an unmonitored attack surface. Shadow NHIs are commonly discovered during incident investigations.
• Extension Supply Chain Risk: The risk that a browser extension appears trustworthy in a marketplace but later performs data collection or other malicious behavior. This combines publisher trust, permission scope, and update control, and it matters because the extension can become an identity-bearing channel into sensitive browser sessions.
• In-Browser Data Exfiltration: The theft of data directly from content rendered in the browser, often by scraping the DOM or observing tab activity. This is especially dangerous for AI chat tools, because prompts, responses, and session context can be copied after authentication and sent to attacker infrastructure without triggering normal app controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.