Browser extensions expose a new prompt injection path for GenAI

At a glance

What this is: This analysis shows that browser extensions can manipulate GenAI prompts at the DOM layer, creating a man-in-the-prompt path that affects both commercial and internal LLM deployments.

Why it matters: It matters because IAM and security teams cannot treat browser-mediated AI access as a normal application session when extensions can silently change inputs, harvest outputs, and bypass visibility controls.

Context

Browser-based GenAI tools inherit the security properties of the browser session that hosts them. When an extension can read and modify the page DOM, prompt input becomes part of the attack surface, not just the user interface. That creates a governance problem for browser extensions, session trust, and the identity context behind each AI interaction.

For IAM and NHI practitioners, this is not only an application-layer prompt injection issue. It is a browser-mediated access problem in which the user’s authenticated session, the extension’s capabilities, and the AI tool’s data access all intersect. The security boundary moves from the model to the endpoint and the browser.

Key questions

Q: What breaks when browser extensions can alter GenAI prompts inside the session?

A: The assumption that the authenticated user is the only actor in the session breaks down. A browser extension can rewrite prompts, insert hidden instructions, and extract outputs without changing the visible login state. That means session trust becomes conditional on extension behavior, not just user identity or model access.

Q: Why do browser-based GenAI tools increase exfiltration risk for internal data?

A: Because many internal copilots are intentionally connected to mail, documents, shared folders, and other sensitive sources. If an extension can steer the prompt and read the response, it can turn that access into silent data extraction while remaining inside the user’s authorised session.

Q: How can security teams tell whether extension controls are actually working for GenAI?

A: Look for runtime visibility into prompt mutation, injected queries, and result handling inside the browser, not just permission counts or URL blocks. If your controls only score extensions statically, they will miss low-permission extensions that still manipulate GenAI sessions.

Q: Should organisations treat browser controls and AI application controls as the same problem?

A: No. Browser controls govern what can happen inside the session, while application controls govern what the model or SaaS endpoint exposes. For man-in-the-prompt attacks, the browser layer is where the abuse happens, so both layers need separate governance and monitoring.

Technical breakdown

How browser extensions reach GenAI prompts through the DOM

Most web-based GenAI tools render the prompt input inside the page DOM, which means browser extensions with scripting access can inspect or modify the field directly. That is enough to inject hidden instructions, rewrite a user’s query, or harvest prompt content without needing a model exploit. The browser, not the LLM, becomes the control plane for data entry and retrieval. Because this occurs inside the authenticated session, the extension can act with the user’s visible permissions while remaining operationally invisible to tools that only watch network traffic or URL access.

Practical implication: Treat any extension with DOM access as part of the GenAI trust boundary, not as a harmless browser add-on.

Why internal LLMs inherit the browser’s risk surface

Internal copilots and RAG-style assistants often have access to sensitive data because they are designed to answer questions from enterprise content. That design creates a high-value target if the browser session itself can be manipulated. A compromised extension can issue freeform queries, read the response, and exfiltrate the result without leaving the model’s perimeter. Traditional controls such as DLP, SWG, and CASB are weak here because they rarely observe the in-browser prompt mutation that drives the abuse path.

Practical implication: Assume browser-mediated AI access can expose any data the authenticated user can reach, including shared enterprise content.

Why permission-based extension review misses this class of abuse

The key failure mode is that the extension does not need special permissions to be dangerous. If a security model relies on static permission counts or basic allowlists, it will miss extensions that can still script the page and interact with GenAI prompts. This is a session-trust problem, not just a permissions problem. In practical terms, the browser session itself becomes a privileged execution environment for prompt tampering and covert data movement, even when the extension appears low-risk on paper.

Practical implication: Move extension governance from static permission scoring to runtime behavior inspection and browser-layer controls.

Threat narrative

Attacker objective: The attacker aims to steal sensitive information from commercial or internal GenAI tools while hiding the evidence of prompt tampering and query execution.

1. Entry occurs when a user installs or already has a compromised browser extension in the session that hosts GenAI tools.
2. Credentialed access is abused when the extension operates inside the user’s authenticated browser context and reads or writes the prompt DOM.
3. Escalation happens when the extension injects hidden instructions, extracts outputs, and steers the LLM to reveal sensitive enterprise data.
4. Impact follows when the resulting data is exfiltrated and the interaction is hidden from normal browser history or application logs.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser-mediated GenAI access creates a man-in-the-prompt governance gap: the security boundary no longer sits at the model or the SaaS URL, but inside the authenticated browser session. Extensions that can script the DOM can change what the user asked and what the model returns. That means enterprise AI governance now has to account for browser behavior as a first-class identity and access surface.

Prompt access is not the same as prompt trust: organisations often assume that a logged-in user is the only meaningful actor in a GenAI session. In reality, the browser extension shares that session context and can operate as an invisible proxy for prompt abuse. The implication is that access review logic built around named users misses the delegated, in-session actor that actually performs the abuse.

Internal LLMs amplify the blast radius of browser compromise: when an enterprise assistant has access to mail, documents, shared folders, or regulated content, the browser becomes a path to high-value knowledge assets. This is a governance problem for data reach, not just a product-security issue. Practitioners should treat AI session exposure as an extension of identity privilege.

Prompt tampering is a browser-layer control problem, not an application allowlist problem: URL blocks and perimeter tools do not see DOM-level manipulation, hidden instructions, or result exfiltration inside the page. The specific failure mode is that existing controls watch destinations while the abuse happens in the session. Security teams need a browser trust model that can distinguish user intent from extension-driven automation.

Man-in-the-prompt is a useful concept for the category: it names the point where browser session control, prompt injection, and data exfiltration converge. That concept helps teams recognise that GenAI risk is not limited to model jailbreaks or API abuse. The practical conclusion is that governance must follow the session, not just the model endpoint.

From our research library:

• Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.

What this signals

Man-in-the-prompt is a browser governance problem: teams that already manage AI access policies still need to account for the browser as an execution environment. Once extensions can read and rewrite prompts, the control point shifts from endpoint allowlisting to session integrity.

The operational takeaway is simple: if the browser session is not trustworthy, the AI interaction is not trustworthy either. That changes how security teams should think about managed endpoints, extension policy, and the lifecycle of browser add-ons in identity-sensitive workflows.

For practitioners

• Audit browser extension trust in GenAI workflows Identify which extensions are permitted in environments where users access ChatGPT, Gemini, or internal copilots, then separate low-risk browsing from AI-enabled work sessions.
• Inspect AI sessions for DOM-level prompt tampering Use browser-layer telemetry or sandboxing controls that can detect prompt edits, hidden instructions, and extension-driven input changes inside the page.
• Restrict high-risk GenAI access by role and device posture Limit exposure of internal LLMs that can reach email, documents, and shared folders to managed endpoints with tighter extension policies and stronger monitoring.

Key takeaways

• Browser extensions can operate inside GenAI sessions without special permissions, which makes prompt tampering a browser trust issue rather than a model-only issue.
• Internal copilots are exposed because they often connect to mail, documents, and shared data that a compromised extension can query and exfiltrate.
• Static extension scoring is not enough when low-permission extensions can still modify prompts and hide their activity inside the session.

Key terms

• Man in the prompt: A browser-side attack pattern where an extension or script reads, changes, or reuses a GenAI prompt inside the user’s session. The model itself may be healthy, but the interaction channel is compromised, allowing silent data extraction or instruction injection.
• DOM-level prompt manipulation: Direct editing or inspection of the prompt field through the page’s Document Object Model. This matters because browser extensions with scripting access can change AI inputs and outputs without exploiting the model itself or needing privileged application credentials.
• Browser-session trust: The degree of authority and confidence a security programme assigns to an authenticated live browser session. In agentic SaaS workflows, this trust can exceed what the account holder intentionally granted, so governance must consider runtime behaviour as well as login state.
• Prompt-based exfiltration: Data leakage that occurs when users paste sensitive information into GenAI prompts or browser-based AI tools. The content leaves the enterprise through interaction rather than file transfer, which makes traditional file DLP insufficient on its own.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.