Browser prompt injection exposes a new LLM data theft path

At a glance

What this is: Swarmnetics shows that browser prompt injection can weaponise a single extension to exfiltrate LLM chat content and connected data from tools such as ChatGPT and Google Gemini.

Why it matters: It matters because the control boundary is no longer just the model prompt or the LLM application, but the browser extension layer and the connected data sources that can be read and erased silently.

Context

Browser prompt injection is a trust-boundary failure, not just a model-safety issue. A browser extension can inherit enough permission to script into an LLM session, then use that access to read prompts, harvest data from connected services, and erase traces before the user notices.

The governance gap is that most organisations still separate browser management, SaaS permissions, and AI oversight into different controls. This attack pattern shows those layers are now coupled, especially when LLMs are connected to email, documents, chats, and other identity-rich sources.

Key questions

Q: What breaks when a browser extension can script an LLM session?

A: The trust boundary breaks at the browser layer, because the extension can inject prompts, read responses, and manipulate the session without looking like a traditional exploit. That turns a convenience feature into an execution path. Security teams need to assume any extension with DOM access can participate in data theft if the LLM is connected to sensitive services.

Q: Why does prompt injection become more dangerous as LLM agents connect to tools and data sources?

A: Prompt injection becomes more dangerous because the agent is no longer just generating text. Once it can call tools, read data sources, or trigger workflows, a malicious instruction can influence real-world actions. That expands the attack surface and creates a Confused Deputy risk, where the agent follows attacker intent using legitimate permissions and performs actions the organization never intended.

Q: What are the signs that browser-based prompt injection is evading detection?

A: Look for unusual background tab activity, scripted prompt entry, hidden interaction with AI pages, and chat sessions that disappear or are deleted after suspicious use. The attack often looks legitimate to the browser, so the main symptom is behavioural inconsistency rather than malware alerts or broken functionality.

Q: Should organisations treat browser hardening and AI governance as the same control area?

A: Yes. If LLMs are accessed through browsers and connected to enterprise data sources, the browser becomes part of the AI control plane. Governance should cover extension approval, connector scope, and interaction monitoring together. Separate ownership creates gaps that prompt injection can exploit before security teams see a model-specific problem.

Technical breakdown

How browser prompt injection reaches the LLM session

A malicious or hijacked browser extension can use the browser's existing scripting capability to inject commands into a live LLM conversation. The key point is that the extension does not need new privileges if the browser already allows DOM-level interaction with the page or tool interface. That makes the attack blend into ordinary browser behaviour, especially when the LLM is accessed through a web UI. In practice, the browser becomes the execution surface for the prompt attack, and the model only sees apparently legitimate input.

Practical implication: Treat browser extensions as part of the AI attack surface and restrict which extensions can interact with LLM workflows.

Why connected data sources raise the theft risk

The risk increases sharply when the LLM is connected to services such as Google Workspace. In that case, the injected prompts can steer the model toward emails, messages, documents, and contact lists, then move that content into attacker-controlled logs or exfiltration channels. This is not a model-leak problem alone. It is a delegation problem, where the LLM is allowed to operate across identity-rich data sources that were not designed for adversarial prompt control.

Practical implication: Review every connector and delegated data source as a potential exfiltration path, not just as a productivity integration.

Why detection is difficult once the attack is running

These attacks are hard to detect because the malicious activity often looks like legitimate browser-assisted interaction. The extension is operating through approved browser permissions, so security tools may not see a classic exploit or malware signature. The attacker can also delete chat history after exfiltration, reducing visible evidence for users and investigators. That means the relevant control is not post-event log review alone, but continuous visibility into browser-to-LLM interactions and extension behaviour.

Practical implication: Add behavioural monitoring for browser and DOM activity around LLM use, and do not rely on chat history as evidence.

Threat narrative

Attacker objective: Steal sensitive content from LLM sessions and connected business services while avoiding detection.

1. Entry occurs when an attacker installs a malicious browser extension or hijacks an existing legitimate extension already present in the browser.
2. Credential access and collection happen when the extension scripts prompts into the LLM, reads chat content, and pulls data from connected services such as Google Workspace.
3. Impact occurs when the extension logs stolen content and deletes the chat history, leaving the user with little visible evidence of the theft.

Breaches seen in the wild

• Chevrolet chatbot $1 Tahoe 2023: Users made a Chevrolet dealer's ChatGPT chatbot agree to sell a 2024 Tahoe for $1 and write code; no sale was honoured and the bot was taken offline.
• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser extensions have become part of AI governance. This attack pattern shows that the browser is no longer a neutral access layer when LLMs live inside it. The real control problem is delegated execution through extension permissions, which means AI governance now extends into browser management and extension approval. Practitioners should treat browser-to-LLM interaction as a governed pathway, not a convenience feature.

Connected LLMs create identity-rich exfiltration paths. Once an LLM can reach email, documents, chats, and contact lists, the model becomes a broker across highly sensitive data domains. That changes the blast radius of prompt injection from a model output issue to an access-control issue. The named concept here is browser-to-LLM trust leakage: permissive browser and connector controls let an attacker move from prompt control to data theft.

This is a non-human access governance problem masquerading as an AI safety issue. The extension is effectively a non-human actor using browser permissions to manipulate another non-human system and its connected sources. That intersection belongs in NHI governance, because the abuse path is about delegated machine access, not human mistake alone. Teams should map which extensions and connectors can act on behalf of users and services, then govern them as privileged software identities.

Detection must move from content inspection to interaction inspection. The article's core warning is that the malicious action may look legitimate to the browser and to security tooling. That weakens controls that depend on post-facto review of chat content or model responses. Practitioners should focus on DOM interaction, extension behaviour, and connector scope as the real enforcement points.

Browser-based prompt injection is accelerating the convergence of endpoint, identity, and AI controls. Security teams can no longer separate the browser hardening conversation from AI risk management. The practical conclusion is that LLM adoption now requires controls over extension inventory, delegated access, and connected data sources as a single governance domain.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Security Platform Buyer's Guide

What this signals

Browser-to-LLM trust leakage: browser extensions, AI connectors, and delegated permissions now form a single governance surface, which means endpoint policy and AI risk policy can no longer be owned separately. The immediate priority is to decide which extensions are allowed to interact with AI sessions at all, then apply continuous review to the rest.

Where LLMs can reach identity-rich systems such as email, documents, and chat, the exfiltration problem is no longer limited to prompt content. In 2025, AI-related credential leaks surged 81.5% year-over-year, according to the State of Secrets Sprawl 2026, which is a useful signal of how fast surrounding AI infrastructure can become the weaker layer.

For practitioners

• Constrain browser extension privileges Restrict which extensions can run in browsers used for LLM access, and remove anything that does not have a current business need. Treat extension review as part of AI access governance, not just endpoint hygiene.
• Inventory LLM connectors and delegated data sources Map every connected service that an LLM can read from or act on, including email, messaging, documents, and contacts. Reassess whether each connector should exist at all and whether its scope is narrower than the data it can reach.
• Monitor DOM interactions around AI tools Collect behavioural telemetry for browser-to-LLM interactions so unusual scripted prompt entry, background tab activity, and hidden chat manipulation can be detected earlier than after-the-fact content review.
• Review extension allowlists continuously Revalidate approved extensions on a recurring basis because a trusted extension can later be altered, hijacked, or turned into a covert prompt injection path without changing the user experience.

Key takeaways

• Browser prompt injection turns extension-level access into a covert path for reading, logging, and deleting LLM content before users notice.
• The risk expands sharply when LLMs can reach connected business systems, because prompts can be redirected into emails, documents, messages, and contacts.
• Browser oversight, connector scope, and AI governance now need to be managed as one control surface rather than as separate programmes.

Key terms

• Browser-based Prompt Injection: A browser-based prompt injection is malicious content placed on a webpage so that an AI assistant reading or summarising the page can be influenced by attacker-written instructions. In practice, the risk is not code execution in the browser alone, but the transformation of untrusted page text into trusted assistant output.
• Browser-to-LLM Trust Leakage: The loss of a clean boundary between browser permissions and AI session control. When the browser can script the model interface, an attacker can move from page interaction to data theft without needing a classic malware payload.
• Delegated AI Authority: Delegated AI authority is the permission a person gives an assistant to act inside business systems on their behalf. It turns a conversational tool into an execution layer, which means security teams must govern scope, auditability, and revocation with the same seriousness they apply to privileged access.
• DOM Interaction Monitoring: Behavioural inspection of browser page interactions to detect suspicious scripted activity. In AI contexts, it focuses on how a browser, extension, or automation layer is entering prompts, changing chat content, or manipulating tool flows rather than on model output alone.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and IAM practitioners align identity controls with emerging AI-driven access patterns.