Topic starter
12/06/2026 12:25 am
TL;DR: Browser extensions with no special permissions can read and alter GenAI prompts, inject hidden instructions, and exfiltrate results across tools such as ChatGPT and Gemini, with 99% of enterprise users already running at least one extension, according to LayerX Security. The security problem is no longer just model abuse; it is browser-level identity and session trust collapse.
Editorial analysis by NHI Mgmt Group, based on content published by LayerX Security: “Top 5 GenAI Tools Vulnerable to Man-in-the-Prompt Attack, Billions Could Be Affected”.
Key questions
Q: What breaks when browser extensions can alter GenAI prompts inside the session?
A: The assumption that the authenticated user is the only actor in the session breaks down.
Q: Why do browser-based GenAI tools increase exfiltration risk for internal data?
A: Because many internal copilots are intentionally connected to mail, documents, shared folders, and other sensitive sources.
Q: How can security teams tell whether extension controls are actually working for GenAI?
A: Look for runtime visibility into prompt mutation, injected queries, and result handling inside the browser, not just permission counts or URL blocks.
Practitioner guidance
- Audit browser extension trust in GenAI workflows Identify which extensions are permitted in environments where users access ChatGPT, Gemini, or internal copilots, then separate low-risk browsing from AI-enabled work sessions.
- Inspect AI sessions for DOM-level prompt tampering Use browser-layer telemetry or sandboxing controls that can detect prompt edits, hidden instructions, and extension-driven input changes inside the page.
- Restrict high-risk GenAI access by role and device posture Limit exposure of internal LLMs that can reach email, documents, and shared folders to managed endpoints with tighter extension policies and stronger monitoring.
Bottom line: Browser extensions can operate inside GenAI sessions without special permissions, which makes prompt tampering a browser trust issue rather than a model-only issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 9:38 am
Browser-mediated GenAI access creates a man-in-the-prompt governance gap: the security boundary no longer sits at the model or the SaaS URL, but inside the authenticated browser session. Extensions that can script the DOM can change what the user asked and what the model returns. That means enterprise AI governance now has to account for browser behavior as a first-class identity and access surface.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should organisations treat browser controls and AI application controls as the same problem?
A: No. Browser controls govern what can happen inside the session, while application controls govern what the model or SaaS endpoint exposes. For man-in-the-prompt attacks, the browser layer is where the abuse happens, so both layers need separate governance and monitoring.
👉 Read our full editorial: Browser extensions expose a new prompt injection path for GenAI