Prompt poaching in browser extensions exposes AI chats

At a glance

What this is: Malicious browser extensions are secretly collecting AI chat content from browser tabs and sending it to external servers, with cloned extensions and post-installation tampering both used in the abuse pattern.

Why it matters: This matters because browser extensions can become an unmanaged identity and data-exfiltration layer that sits outside IAM, DLP, and approved AI governance processes.

By the numbers:

• 17 minutes.

👉 Read Expel's analysis of prompt poaching in AI browser extensions

Context

Prompt poaching is a browser-side data theft problem: a malicious extension watches AI chat tabs, captures prompts and responses, and forwards them to an external destination. The security gap is not in the AI model itself but in the unmanaged layer between the user, the browser, and the service where sensitive context is often pasted or summarized.

For IAM and NHI programmes, the bigger issue is that browser extensions create an informal access path that is rarely governed like a production tool. That makes them relevant to identity security because they can expose credentials, customer data, or regulated information without ever touching a formal application control plane.

Key questions

Q: How should security teams handle risks from AI browser extensions?

A: Security teams must evaluate the permissions requested by any browser extension before approval. Tightening controls on what can be installed and performing regular audits can help mitigate risks associated with third-party tools operating under misleading premises.

Q: Why do browser extensions create shadow AI risk?

A: Because they can mediate prompts, model access, and secrets outside approved governance channels. If an extension sends prompts to an external server or impersonates a legitimate AI assistant, it is effectively operating as unmanaged AI infrastructure. That is shadow AI whether or not the user intended it.

Q: What do security teams get wrong about blocking AI tools outright?

A: They assume network blocking creates control, but users often shift to personal devices, browser workarounds, or OS-level agents that bypass those restrictions. Blocking can reduce visible risk while increasing shadow AI and making the governance problem harder to measure.

Q: How can teams tell if a browser extension is stealing AI chat data?

A: Look for permissions that exceed the extension’s stated purpose, unusual browser activity toward unknown domains, and behaviour that changes after updates. Because the theft happens inside normal browser sessions, endpoint and browser telemetry are essential for spotting it early.

Technical breakdown

How malicious browser extensions capture AI conversations

These extensions typically monitor the browser for tabs that match common AI services, then extract content using DOM scraping or API interception. DOM scraping reads page elements directly from the rendered interface, while API interception catches traffic or payloads before it is displayed to the user. Once captured, prompts and responses are packaged and sent to attacker-controlled infrastructure. The technique is effective because the browser extension runs with the user’s trust and often with broad page access. It also sidesteps traditional perimeter controls because the data leaves through a normal browser session rather than a separate malware channel.

Practical implication: treat AI-capable extensions as data-collection software, not convenience add-ons, and review what they can read across tabs.

Why cloned extensions create a governance blind spot

A cloned extension inherits the appearance of a legitimate tool while replacing or augmenting the underlying code. That means users see familiar branding and workflow, but the extension can silently introduce new collection logic after installation or in a copied build. The governance problem is that extension review often focuses on the initial package name and visible features, not on later behaviour, permission scope, or update control. Once an extension has a large installed base, malicious activity can blend into normal browser traffic and remain unnoticed until users report unexpected behaviour or sensitive data appears elsewhere.

Practical implication: control extensions as a lifecycle problem, including approval, update review, and periodic inventory checks.

How prompt poaching turns browser activity into identity and data risk

AI conversations frequently contain usernames, tokens, internal project details, customer information, and workflow context. That makes browser extension theft more than a privacy issue, because the stolen content can support phishing, account takeover, and social engineering against both people and systems. In identity terms, the extension becomes an unreviewed intermediary with visibility into sensitive interactions that should have been limited to sanctioned tools. The risk grows when employees use personal browser profiles or install extensions outside managed channels, because the organisation loses both oversight and revocation leverage.

Practical implication: align browser extension governance with identity governance by restricting unmanaged add-ons on corporate endpoints.

Threat narrative

Attacker objective: The attacker wants to turn routine AI chat activity into a steady stream of sensitive text that can be monetised, abused for phishing, or used to expose corporate information.

1. Entry occurs when a user installs a cloned or repurposed browser extension that appears legitimate but requests broad browser access.
2. Escalation occurs when the extension monitors AI tabs and uses DOM scraping or API interception to collect prompts and responses.
3. Impact occurs when the captured content is exfiltrated to external servers and later used for identity theft, phishing, or resale of sensitive information.

NHI Mgmt Group analysis

Prompt poaching is browser-extension governance failure, not an AI model failure. The malicious behaviour happens at the browser layer, where extensions can observe AI tabs and extract text without crossing the AI provider’s own controls. That shifts the control problem from model safety to endpoint governance, extension approval, and browser telemetry. Practitioners should treat the browser as part of the identity boundary, not a neutral interface.

Unmanaged extensions create a shadow access path to sensitive conversations. Users install them to close a productivity gap, but the resulting toolchain often bypasses sanctioned identity, data-loss, and review processes. Where browser add-ons can see prompts, they can also see credentials, client details, and internal context. The practical conclusion is that extension sprawl belongs in the same governance conversation as unmanaged SaaS and unsanctioned AI use.

Prompt poaching widens the blast radius of everyday knowledge work. AI chat content is increasingly a container for confidential business context, which means exfiltration can reveal more than a single query. It can expose repeated workflows, internal terminology, and references that support follow-on social engineering. The defensive priority is to narrow what browsers can observe and to make approved AI access paths the easiest path for users.

Browser extensions should be managed as a lifecycle control, not a point-in-time allowlist. A once-approved extension can change behaviour through updates, ownership changes, or hidden functionality added after adoption. That is why continuous inventory, permissions review, and process monitoring matter. For identity programmes, the lesson is clear: governance must follow the software that mediates access, not just the service being accessed.

What this signals

Prompt poaching expands the attack surface around AI adoption faster than most identity programmes can absorb. Users are moving sensitive work into browser-based AI workflows before organisations have decided how to govern extensions, update channels, and approved interaction paths. The practical signal is that browser control is becoming an identity-adjacent capability, because the browser now mediates access to data that should be handled inside sanctioned tools.

Secret exposure and prompt theft now reinforce each other. Once a browser extension can observe chats, it can collect credentials, internal system references, and operational details that help attackers pivot into other environments. The pace at which exposed secrets are abused means security teams need to link browser telemetry, secrets governance, and IAM review rather than treating them as separate problems.

Extension governance should move from reactive cleanup to preventative boundary control. That means standardising approved AI tools, limiting extension installation paths, and monitoring for anomalous domain contacts from browser processes. The broader signal is that unmanaged browser add-ons are becoming part of the hidden control plane around identity-sensitive work.

For practitioners

• Block unapproved browser extensions on managed endpoints Use browser management consoles or Group Policy to enforce an allowlist for extensions that have been reviewed for permissions, update behaviour, and data access across tabs.
• Review extension permissions against advertised function Flag any extension whose requested privileges extend beyond basic tab access, especially if it can read page content, inject scripts, or contact unknown domains.
• Inventory extensions continuously Run periodic audits of installed extensions and correlate them with browser process activity that repeatedly connects to unfamiliar external servers.
• Prefer official AI tools over third-party add-ons Direct users toward desktop clients, mobile apps, or browser extensions published by the AI provider itself so that AI workflows stay inside sanctioned channels.
• Treat browser data exposure as identity risk Escalate any extension that can observe prompts containing credentials, customer data, or internal project details into IAM, PAM, and security awareness reviews.

Key takeaways

• Malicious browser extensions can turn AI conversations into an exfiltration stream without touching the AI service itself.
• The governance failure is extension sprawl and permission drift, not just unsafe user behaviour.
• Security teams should control browser add-ons, provide sanctioned AI tools, and treat prompt theft as an identity and data risk.

Key terms

• Prompt Poaching: Prompt poaching is the covert capture and forwarding of user prompts, conversations, or related context to an unapproved external system. In browser and AI tooling, it often hides behind a legitimate-looking interface, turning user trust into an unwitting data transfer path.
• Browser Extension Identity: A browser extension identity is the effective authority granted to an add-on once a user installs it and approves permissions. In practice, that authority can include reading page content, observing tabs, and interacting with web apps, which makes the extension a governed non-human actor.
• Access Sprawl: The gradual accumulation of permissions across users, services, and integrations until no one can easily explain why access still exists. In NHI environments, it often appears when machine identities keep inherited rights long after their original business purpose has changed.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• The extension names and indicators of compromise associated with prompt poaching behaviour.
• The permission patterns and browser signals that help distinguish legitimate AI add-ons from malicious ones.
• The practical steps for managing browser extensions through enterprise policy and review workflows.
• The extension inventory and monitoring approach that supports ongoing detection of suspicious outbound connections.

👉 The full Expel post covers the extension examples, permission checks, and browser monitoring details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity for practitioners who need to secure access paths and reduce unmanaged credential risk. It helps identity and security teams connect access control decisions to real-world identity exposure across modern environments.