TL;DR: Malicious browser extensions are monitoring and exfiltrating AI conversations through “prompt poaching,” including cloned extensions and later-stage feature insertions, according to Expel. The risk is not just privacy loss but exposed corporate data, targeted phishing opportunities, and unmanaged browser extensions that bypass security review.
At a glance
What this is: Expel describes “prompt poaching” as malicious browser extensions that monitor AI chat tabs, capture prompts and responses, and send them to external servers.
Why it matters: This matters because browser extensions can become an unmanaged path for sensitive data exposure, especially when users bring AI tools into everyday work browsing without extension governance.
Context
Prompt poaching is a browser-extension abuse pattern, not an AI-model flaw. The security gap is that extensions can observe tab content, intercept page activity, and move data outside the enterprise control plane while users still think they are only adding convenience.
The identity angle is real because AI conversations often contain credentials, confidential business context, or instructions that should remain scoped to the user and the session. Once an extension can read the browser context, it can turn routine productivity tooling into an exfiltration path that bypasses normal review and logging.
This pattern is not typical of a well-governed extension estate. It usually appears where users self-install productivity add-ons faster than security teams can inventory, approve, and constrain them.
Key questions
Q: What breaks when browser extensions can read AI chat content and tab URLs?
A: The browser session stops being a clean trust boundary. An extension with page access can scrape prompts, responses, and open-tab context after the user has authenticated, which means sensitive data can leave through a channel that IAM, DLP, and endpoint tools often do not model well enough.
Q: Why do malicious extensions create more than a privacy problem?
A: Because the captured content often includes corporate context, internal references, customer information, or even credentials pasted into chat. That creates downstream risk for phishing, impersonation, and data resale. The impact is operational as well as personal, so identity and data teams need to treat browser-based AI use as a governed information flow.
Q: How can teams tell if a browser extension is stealing AI chat data?
A: Look for permissions that exceed the extension’s stated purpose, unusual browser activity toward unknown domains, and behaviour that changes after updates. Because the theft happens inside normal browser sessions, endpoint and browser telemetry are essential for spotting it early.
Q: Should organizations block AI browser extensions or manage them more tightly?
A: Manage them tightly rather than banning AI tools outright. A blanket ban can push users to unsanctioned workarounds, but unmanaged extensions create covert collection paths. The better control is to approve specific add-ons, restrict permissions, inventory installs, and align browser policy with AI usage rules and data handling requirements.
Technical breakdown
How malicious browser extensions read AI chat tabs
A browser extension runs with permissions that can exceed what its marketing suggests. In this pattern, the extension watches for tabs that load AI chat interfaces, then collects prompts and responses through DOM scraping or API interception. DOM scraping means reading the page structure and visible text, while API interception means observing calls the page makes behind the scenes. The extension then forwards that content to an external server controlled by the operator. The core issue is that browser permission grants can be broad enough to let a trusted-looking add-on inspect conversations without needing separate prompts from the user.
Practical implication: Treat extension permissions as data-access permissions, not convenience settings.
Why cloned extensions are a durable delivery method
Cloning a popular extension lowers suspicion because the interface and function appear familiar, even when the code has been modified. Attackers can also wait until an extension builds a large user base and then insert malicious functionality later, which makes the compromise harder to spot through initial install review alone. This is a lifecycle problem: trust is established first, abuse is introduced later, and the same install base remains in place. For defenders, the relevant control is not only initial approval but continuous review of extension lineage, update behavior, and network destinations.
Practical implication: Monitor extension updates and ownership changes, not just first-time installs.
Why AI chat exposure becomes an identity and data problem
AI chat prompts often contain confidential business content, customer details, internal plans, or tokens pasted by users trying to accelerate work. When an extension captures that material, it can expose more than a conversation. It can reveal identity-linked information, workflow context, and follow-on opportunities for phishing or impersonation. That is why browser extension governance belongs in identity and data security conversations, not only endpoint management. The control gap is unmanaged data flow from the browser session to an untrusted third party.
Practical implication: Classify AI chat content as sensitive browser data and govern where it can be observed.
Threat narrative
Attacker objective: The attacker wants to harvest AI conversation content at scale from trusted browser sessions and reuse it for theft, resale, or follow-on social engineering.
- Entry occurs when users install a browser extension that appears legitimate, often after seeing functionality similar to an approved productivity tool.
- Credential or data harvesting happens when the extension inspects AI chat tabs and captures prompts, responses, or pasted business context through DOM scraping or API interception.
- Escalation occurs when the operator adds malicious functionality after the extension has already built user trust and a large install base, extending exposure to existing users.
- Impact is the silent exfiltration of sensitive AI conversation data to external servers, creating privacy loss, corporate data exposure, and downstream phishing risk.
Breaches seen in the wild
- postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Prompt poaching is a browser governance problem first and an AI privacy problem second. The extension is the control point, because it sits where users mix sanctioned and unsanctioned data flows inside the browser. If security teams focus only on the AI application, they miss the place where the capture actually occurs. Practitioners should treat extension approval, update control, and network egress as one governance surface.
Extension trust is too often assumed at install time and never revalidated. That assumption breaks when a harmless-looking add-on later changes ownership, gains new functionality, or receives a malicious update. The named failure mode here is extension trust drift, where the original approval no longer matches the live code path. Security teams should design for lifecycle verification, not one-time allowlisting.
Browser extension sprawl is becoming an identity and data exposure channel. AI prompts are not just transient text, because they can contain credentials, internal references, and decision context tied to people and projects. Once that data is observed by an extension, the enterprise loses control over its downstream use. The practical conclusion is simple: govern browser add-ons as data-handling components, not cosmetic productivity tools.
Sanctioned AI access is now part of extension risk reduction. Users reach for browser add-ons when official tools do not fit their workflow, which means unmanaged demand is part of the attack surface. The right response is to close the productivity gap with approved tools and tighter browser controls. That reduces shadow extension adoption and makes the control environment more defensible.
Extension telemetry should be treated as part of AI governance. Browser observability, egress monitoring, and permission review provide the evidence needed to distinguish normal productivity use from covert collection. Without that, organizations are certifying the browser while the browser is exporting the conversation. Practitioners should fold browser extension oversight into broader identity and data governance programmes.
From our research library:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Read next: Top 10 NHI Issues
What this signals
Browser extension governance is now part of AI data-loss prevention. When users bring AI into the browser, the browser itself becomes the place where sensitive content can be observed, copied, and moved. Teams that only govern the model or the sanctioned AI app will miss the exfiltration path created by add-ons and plugins.
Prompt poaching widens the gap between sanctioned AI and shadow AI. Users install convenience extensions to bridge workflow friction, and that friction is itself a governance signal. The safer response is to reduce the need for unsanctioned add-ons by providing approved AI access patterns and then controlling browser extension sprawl around them.
Security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec. That concern maps directly to prompt poaching, because the browser can become the pathway that leaks sensitive patterns from everyday work into untrusted hands.
For practitioners
- Block unapproved browser extensions Use browser management controls and policy enforcement to allow only extensions that have been reviewed, approved, and tied to a clear business need.
- Review extension permissions before approval Compare each extension's requested permissions with its advertised function and reject add-ons that ask for broad tab, page, or network access without justification.
- Prefer vendor-built AI clients and extensions Steer users toward official desktop apps, mobile apps, or extensions published directly by the AI provider so the browser add-on supply chain is narrower and easier to govern.
- Inventory installed extensions continuously Run periodic audits across managed browsers, track ownership changes and update behavior, and watch for processes that connect to unknown external domains.
Key takeaways
- Malicious browser extensions can turn AI chat sessions into an exfiltration channel even when the AI service itself is well governed.
- The core failure is extension trust drift, where approval at install time does not protect against later code changes or ownership changes.
- Browser extension controls should sit alongside AI usage policy, permission review, and network monitoring to reduce covert collection.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centers on extensions silently collecting AI conversation data. |
| NHI-10 — Human Use of NHI | Users are handling AI conversations through unmanaged browser tools that mediate sensitive content. | |
| Recommendation — Scan browser add-ons for secret leakage paths and revoke extensions that can observe AI chats. Set policy for human use of AI-connected browser tooling and restrict unsanctioned extensions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Extension permissions act as access grants to browser content and outbound data flow. |
| Recommendation — Apply PR.AA-05 to limit extension permissions to the minimum needed for approved use cases. | ||
| CIS Controls v8 | CIS-5 — Account Management | Enterprise browser extension governance depends on approved inventory and controlled lifecycle management. |
| Recommendation — Use CIS-5 processes to inventory, approve, and remove browser extensions across managed devices. | ||
| MITRE ATT&CK | TA0009; TA0010 — Collection; Exfiltration | The threat pattern is covert collection of chat content followed by outbound transfer. |
| Recommendation — Map suspicious extension behavior to TA0009 and TA0010 to prioritize detection and containment. | ||
Key terms
- Prompt Poaching: Prompt poaching is the covert capture and forwarding of user prompts, conversations, or related context to an unapproved external system. In browser and AI tooling, it often hides behind a legitimate-looking interface, turning user trust into an unwitting data transfer path.
- Browser Extension Privilege: The access a browser add-on receives through the user’s browser context and granted permissions. In practice, this can include cookies, tabs, page content, and scripting rights, which makes an extension capable of influencing authenticated sessions and web workflows without separate identity controls.
- DOM Scraping: DOM scraping is the extraction of visible page content by reading the browser's document object model. In this context, it allows an extension to capture chat text directly from the rendered page without needing access to the underlying service or API credentials.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and agentic AI identity. It helps practitioners connect identity control to the broader access and data flows their programmes must govern.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org