Contents5
On 16 October 2026, the tech press detailed ChatGPT’s new Chrome extension: mentioning the browser in a conversation is enough for the assistant to read the open tabs and, in its work mode, act in them itself, from filling in a form to sending a message. Two weeks earlier, Apple had announced it would tighten full disk access on Macs, citing AI agents. For a business, the question is not whether these tools are useful, but what they see when an employee has the CRM open in the next tab.
This post in our Business AI section starts from that example, but the rule applies to any assistant that reads the browser or the screen, whoever makes it. The permissions described are those in the documentation consulted on 20 October 2026, and they change with updates; this is not legal advice: for personal or regulated data, your DPO has the final say.
In short
A browser assistant reads the tabs it is pointed to and can act on sites where you are already signed in, with your permissions.
The main risk is not the page you show it, it is the tab next door: CRM, email, bank, HR tool.
A page’s content can hijack an agent; the vendor itself says to treat it as untrusted.
The rule fits in three levels: public sites allowed, internal tools avoided, personal or regulated data forbidden.
What the assistant sees, and what it can do
In chat mode, the extension pulls information from several tabs at once to compare or summarise; in work mode, it can send messages, fill in forms, download files and organise tabs, reports The Decoder, adding that the update covers every ChatGPT plan.
OpenAI’s documentation details the permissions. At installation, the extension asks, among other things, to “read and change all your data on all websites” and the browsing history on all your signed-in devices. It can then use sites where you are already signed in. Before acting on a new site, it asks for permission: once, for this site, for all sites, or decline; the “all sites” option is flagged as an elevated risk, and access to history is requested every time.
Treat page content as untrusted context, and review the website before allowing ChatGPT to continue.
The same documentation advises against sending secrets or highly sensitive data through these tasks, unless necessary and while staying present to review each request. The vendor says so itself: the tool is built to be powerful, and caution falls to whoever uses it.
The risk is the tab next door
An employee comparing three supplier offers exposes nothing. The same employee, with their email, a customer record in the CRM and the website’s admin console in the same window, gives the assistant a view and permissions that nobody decided to grant it. Two mechanisms explain why:
- An open session is an identity: an agent acting in a tab where you are signed in acts with your permissions, without asking for a password again.
- A page can give orders: hidden text in a visited page can push the agent to copy what it sees elsewhere, as OpenAI’s documentation warns about browsing history. The mechanism is described in our review of AI agents and the cyberattacks of October 2026.
Apple makes the same diagnosis for the Mac, where full disk access lets an app read files, email and messages.
As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.
The rule, tab by tab
Allowed with a browser assistant
Public pages: articles, documentation, product pages
Comparing supplier or competitor offers
Your own already published content
Drafts with no customer data or internal figures
Keep out of its reach
CRM, customer records and quotes in progress
Work email and calendar
Banking, payments, payroll and HR tools
Admin consoles and the password manager
Three settings complete the list: never grant access to “all sites”, refuse history by default, and keep the mode where the assistant acts alone for public sites, with someone at the screen. Sensitive tools are best kept in a separate browser profile with no AI extension: it is the simplest way to make sure the tab next door stays invisible.
From the field
This rule follows the sensitivity grid we have applied to our own AI use since August 2026 (internal rule, in its 20 October 2026 version), written into our cost and data reference: public content may go through any tool, internal non-personal content only through tools that do not retain data, personal or regulated data only on our servers or with a European provider under contract, never on a model offered without a contract. A tab is classified like a document.
What it changes for a team of 20 to 500 people
These extensions install in one click, often on a personal account: if the AI policy says nothing, the default setting decides. Three decisions are enough to take back control:
- Which browser assistants are allowed, with which account (business, managed) and on which machines.
- Which sites are allowed or excluded, starting from the list above; OpenAI’s extension itself offers lists of allowed and blocked sites.
- Who may let the assistant act, and on what.
Where these decisions fit in an overall policy is described in our guide to enterprise AI governance; the alternative of an assistant running on your own infrastructure in private AI in four levels; and protecting the keys and passwords these tools might come across in a secrets vault for AI. To place this rule in a complete project, see our guide to integrating AI in your business.
So that everyone knows what to hand to AI and what to keep, with usage rules written for your company and workshops by role, see our AI training for teams.
Frequently asked questions
Can an AI assistant read my open browser tabs?
Yes, if it is installed as an extension and you ask it to. ChatGPT’s Chrome extension reads the tabs the user points to in the conversation and, in its work mode, can act in them. It asks for permission before acting on a new site and each time it wants the browsing history. What it sees therefore depends on what is open and what you allow.
Should a business ban AI browser extensions?
Not necessarily. Banning them often pushes employees towards personal accounts, outside any control. It is better to allow one specific tool, on a business account, with a list of allowed and excluded sites, and a separate browser profile for sensitive tools. The rule fits on one page of the AI policy.
Can a browser assistant act on my behalf on a site where I am signed in?
Yes. An extension acting in a tab where your session is open uses your permissions, without asking for a password again. That is why per-site permissions matter: keep automatic actions for public sites, refuse the option that opens every site, and stay at the screen while the assistant fills in a form or sends a message.
Why is Apple restricting full disk access because of AI agents?
Because that access bypasses much of the Mac’s protection: an app that obtains it can read files, email, messages and browsing history. On 2 October 2026, Apple announced additional controls so that only an explicit user action can grant it, explaining that the risk grows as agents become more autonomous.
Sources
- Reports The Decoder (new tab)the-decoder.com
- OpenAI’s documentation (new tab)learn.chatgpt.com
Jim · founder of Brain Plus AI
Also in business ai
Practical guide12 min
Enterprise AI governance: who can access what
An AI assistant reads whatever your access rights let it read, sharing mistakes included. Here is how to split your knowledge bases by department, keep a common core and decide who writes to the shared memory.
Choose and price9 min
Private AI in business: the four levels of control
A "private" AI is not a product, it is a degree of control over your data. We distinguish four levels, from an API used as is to a model installed on your premises, and a simple way to choose task by task.
Understand12 min
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.