TL;DR: Sixteen Chrome extensions marketed as ChatGPT productivity tools intercepted session authentication tokens and sent them to a third-party backend, enabling account-level access to chats, metadata, and connected data sources, according to LayerX Security. The case shows that browser extensions can bypass traditional app security boundaries and turn everyday productivity tooling into identity compromise.
At a glance
What this is: LayerX Security found a campaign of 16 malicious Chrome extensions that stole ChatGPT session tokens and used them to access user accounts, chat history, metadata, and connected data sources.
Why it matters: IAM and NHI teams need to treat browser extensions that touch authenticated AI services as privileged software, because session theft can bypass platform controls without exploiting the application itself.
Context
Browser extensions that run inside authenticated web sessions can observe and reuse security artifacts that were never meant to leave the browser. In this case, ChatGPT extensions were used to intercept session tokens and send them to a third-party backend, turning a convenience layer into an identity exposure point.
The governance gap is not limited to ChatGPT. Any enterprise that allows third-party AI extensions to operate alongside authenticated web apps has to account for runtime access, token interception, and hidden data flows that sit outside normal application review and PAM-style oversight.
Key questions
Q: What breaks when session tokens are exposed through browser extensions?
A: When session tokens are exposed, account possession becomes enough for impersonation. The attacker does not need the password or a new login flow. They can reuse the active token to access conversations, metadata, and any connected service reachable from that session, which turns one browser compromise into broader identity exposure.
Q: Why do browser extensions create more account takeover risk for AI tools?
A: They run close to the authenticated session, often with enough runtime access to observe headers, state, and other in-memory artifacts. That makes them a practical credential theft path, especially when users install them for productivity and grant broad browser permissions without review.
Q: How do security teams know whether extension ecosystems are exposing credentials?
A: Look for extensions that request broad filesystem, network, or shell access, especially on machines that also handle source control and cloud access. Then trace whether those extensions can reach tokens, signing keys, or build artefacts. If an extension can read or transmit those assets without tight controls, it has crossed into identity risk.
Q: What should organisations do about ChatGPT extensions that access enterprise data?
A: They should govern them like privileged software, not casual add-ons. That means approving only known tools, limiting access to authenticated AI services, and removing any extension that can reach chat history or connected data sources without a clearly justified business need.
Technical breakdown
How browser extension code captures session tokens
These extensions inject content scripts into the page and execute them in the browser’s MAIN world, where they share the same runtime context as the web application. That placement lets the extension hook functions such as window.fetch, inspect outbound requests, and read authorization headers before they are fully handled by the app. Because the code runs inside the same execution environment, it can observe in-memory authentication artifacts that traditional network controls may never see.
Practical implication: review extensions that request MAIN-world access as privileged code paths, not ordinary add-ons.
Why token theft becomes account-level compromise
A ChatGPT session token is effectively a bearer credential for the active user session. Once stolen, it can be replayed to access conversation history, metadata, and connected services tied to that session, including sources such as cloud drives and collaboration tools. The attack does not need to break ChatGPT itself, because it abuses the trust boundary around the browser session and the application’s authenticated state.
Practical implication: protect session-bearing browser workflows as identity assets with the same caution as reusable credentials.
Why AI browser extensions expand the attack surface
AI-focused browser extensions often need deep integration with authenticated web applications, which increases their privilege and visibility into runtime state. That combination of user trust, broad access, and rapid distribution gives attackers a low-friction path to collect tokens, telemetry, and backend-issued access artifacts across many users. The result is a wider identity surface where malicious code can blend in with legitimate productivity tooling.
Practical implication: build extension governance around data access and runtime behaviour, not just store reputation or install count.
Threat narrative
Attacker objective: The attacker wanted account-level access to ChatGPT sessions so they could impersonate users and reach their conversations, metadata, and connected data sources.
- Entry occurred when users installed browser extensions presented as ChatGPT productivity tools through public extension stores and trusted brand cues.
- Credential access happened when injected scripts intercepted ChatGPT session authentication tokens from outbound requests and sent them to a third-party backend.
- Impact followed when the stolen tokens were replayed to impersonate users and access chats, metadata, and connected data sources tied to those sessions.
Breaches seen in the wild
- GlassWorm campaign 2025: GlassWorm hid in VS Code extensions with invisible Unicode and stole npm, GitHub and Open VSX publishing tokens to spread.
- GitHub internal repositories breach 2026: A stolen GitHub CLI token let attackers publish a poisoned Nx Console extension that harvested secrets and exfiltrated 3,800 GitHub repos.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Browser extensions have become an identity boundary, not just an application extension point: when an extension can run in the same runtime as an authenticated web app, it can observe and reuse session artefacts that traditional app security assumes remain internal. That changes the control model from app vulnerability management to runtime trust management. Practitioners need to treat extension access as part of the identity plane, not the browser cosmetics layer.
Session token exposure now behaves like credential theft, even when no application flaw exists: this campaign did not exploit ChatGPT code; it exploited the trust that authenticated browser sessions place in local execution. That means the relevant governance question is not only whether the app is secure, but whether third-party code is allowed to read and relay bearer artefacts. NHI control thinking applies because the stolen token functions as a machine-usable secret in session form.
Browser extension intelligence is becoming a practical detection domain for identity teams: shared code, synchronized updates, and common backend infrastructure are not just malware signals. They are indicators that multiple listings may be participating in a coordinated credential collection campaign across AI workflows. The named concept here is extension session interception: benign-looking productivity tooling turns into a token exfiltration layer once it can observe authenticated runtime state. Security teams should govern that pattern explicitly.
Identity assurance breaks at the browser layer when user trust is borrowed by third-party code: extension stores, brand mimicry, and high ratings can create a false assurance model that looks nothing like enterprise access governance. The problem is not extension popularity alone; it is that the trust decision happens outside the IAM stack while the resulting credential use still lands inside it. Practitioners should reframe browser extensions as part of access governance and not as low-risk desktop utilities.
AI-powered browser tooling is creating a new class of covert account access: the broader market trend toward AI productivity add-ons means more software will demand deep access to authenticated services and more opportunities will exist to hide abuse inside normal workflows. That increases the need for inventory, approval, and runtime monitoring of extensions that touch sensitive sessions. The practical conclusion is simple: if an extension can read authenticated AI traffic, it belongs in governance scope.
What this signals
Extension session interception: the important shift is not that browsers now host more code, but that third-party code can sit inside authenticated AI workflows and relay bearer tokens before normal controls see the traffic. That makes extension governance part of access governance, not just endpoint hygiene.
Security teams should inventory which browser extensions can execute in the same runtime as authenticated applications and retire any that depend on broad page-level access. The control question is whether a tool can observe session state, not whether it claims to be productivity software.
For practitioners
- Treat authenticated AI extensions as privileged software Classify browser extensions that interact with authenticated AI services as privileged applications and require explicit approval before enterprise use.
- Inspect MAIN-world browser runtime access Review whether extensions execute in the MAIN world, hook native browser functions, or can observe in-memory authentication artifacts.
- Monitor for token interception behaviour Deploy behavior-based controls that flag unusual outbound requests, injected scripts, or extensions that relay authorization headers to third-party domains.
- Restrict third-party AI extension use Limit installation of AI productivity extensions to approved lists and remove tools that require access to authenticated web applications without a business need.
- Review connected data-source exposure Check which browser-mediated AI tools can reach chat history, cloud drives, collaboration apps, or other connected services through the same session token.
Key takeaways
- Browser extensions can turn a trusted AI workflow into an identity compromise path without exploiting the underlying application.
- The campaign described by LayerX Security used session token interception, which gave attackers account-level access to chats, metadata, and connected services.
- Extension approval, runtime monitoring, and session-aware governance are the controls that matter when browser code can sit beside authenticated AI traffic.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The campaign steals session tokens from authenticated browser traffic, which is secret leakage by design. |
| NHI-04 — Insecure Authentication | The stolen tokens are replayed as proof of identity without additional verification. | |
| NHI-10 — Human Use of NHI | Humans are using extensions to handle non-human session material and expanding the trust boundary. | |
| Recommendation — Classify session tokens as secrets and monitor browser extensions for any path that can exfiltrate them. Review whether browser-mediated sessions rely on bearer tokens that can be replayed outside the original context. Separate human browser convenience tools from NHI session handling and tighten approval for tools that touch both. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The core attack path is token harvesting followed by transmission to a third-party backend. |
| Recommendation — Map suspicious extension behaviour to credential access and exfiltration, then hunt for token relay to external infrastructure. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | This article is fundamentally about access scope created by browser extensions and session replay. |
| Recommendation — Apply PR.AA-05 to limit extension access to authenticated workflows and the entitlements they can observe. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Session tokens function as authenticators and need lifecycle and exposure controls. |
| Recommendation — Use IA-5 to govern the issuance, storage, and revocation of session-bearing authenticators. | ||
Key terms
- Session token hijacking: The theft and reuse of an active authentication token so an attacker can enter an application without repeating the normal login process. It matters because a valid session can outlive the original password and bypass controls that only protect the sign-in step.
- MAIN World Execution: MAIN world execution means browser extension code runs inside the same JavaScript context as the web page itself. That gives the extension deeper access than a normal isolated script, including the ability to observe or wrap runtime functions and inspect in-memory state.
- Extension Session Interception: Extension session interception is a browser threat pattern where a third-party extension observes authenticated runtime data and uses it to obtain or relay account access. It matters because the extension may appear harmless while quietly operating inside the trust boundary of sensitive web applications.
- Bearer token replay: Reuse of a captured token by an attacker to make authorised-looking API calls. The token may still be structurally valid, which is why replay prevention depends on path integrity, short lifetimes, and context-aware enforcement rather than token format alone.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org