Six weeks ago, somebody on the team installed a browser AI assistant. It promised to summarise long client emails, draft replies and pull the key points out of attachments. Everyone liked it. Two more people installed it. Nobody read the permission warning, which said it could read and change data on every website visited, because that warning has worn out its meaning. The owner has not looked at it. She would not know where to look. The extension has, in the intervening six weeks, sat quietly inside the browser of three people, reading every page they have opened.
That story is close to the median pattern for a small services firm in 2026. The extensions are useful, they are easy to install, and they sit much closer to the firm’s data than the chatbots the owner is actually worried about.
What does a browser AI extension actually have access to?
Once installed with default permissions, a browser extension can read the content of every web page, every form field as it is being typed, and often the clipboard and the navigation history. Some extensions can also inject code into pages, so they can change what the user sees or capture what they enter. The install-time permission warning is technically accurate, and after a year of clicking “Allow” it has worn out its meaning.
The asymmetry matters because the user only sees one tab at a time. The extension sees every tab. When somebody has their email, their CRM, their bank, their client portal and a HMRC return all open in the same session, an extension with broad permissions sees all of them. The LayerX Browser Security Report for 2025 found that 99% of enterprise users had at least one extension installed and 53% of installed extensions could reach sensitive data such as cookies, passwords and page contents. Across a small team with five or six extensions each, the aggregate footprint is large.
Which categories are typically safe, which are typically risky, and which sit in between?
The lower-risk extensions are scoped to one site or one task, like a password manager on login pages or an ad blocker maintained by a non-profit. The higher-risk categories are sidebar AI assistants, autocomplete and writing helpers, meeting transcribers, screen-capture analysers, and email or CRM AI helpers. The in-between are page summarisers, which read the current page on demand and transmit its content to a remote model.
A useful framing is what the extension would have to send to a third-party server to do its job. A password manager sends nothing during normal browsing. A page summariser sends the content of one page each time you click the button. A sidebar assistant has the standing capability to send any page, at any time, depending on what the user invokes. A writing helper sends, on principle, everything the user composes in a web form. The risk grade tracks the data flow, not the marketing description.
How do you audit what your team actually has installed?
Open chrome://extensions in Chrome, about:addons in Firefox, or the Extensions preference pane in Safari on each machine, and screenshot the list. For each extension, note the name, the developer, the date it was last updated and the permissions it requests. If you run managed devices through Google Workspace or Microsoft 365, the admin console gives you the same view centrally. For a five-person firm without managed devices, the sweep takes twenty minutes.
What you are looking for is the inventory itself. Owners doing this for the first time commonly find at least one extension nobody on the team can explain. They also find a long tail of extensions that have not been updated for over a year, which the LayerX research found accounts for 51% of installed extensions in the average organisation. Out-of-date extensions are not automatically dangerous, but they are an unmaintained dependency sitting inside your firm’s data path. The audit is what makes the rest of the conversation possible. Without it you are guessing.
When should you allow a new AI extension on a work laptop, and when should you decline?
Before any new AI extension goes on a work laptop, ask five questions. What specific data will it read. Where does that data travel. Who is the developer. What is the retention policy. And does the function genuinely require the permissions it is asking for. If you cannot answer three of these in under ten minutes on the developer’s privacy page, the extension is not ready for business use yet.
The five questions are not theoretical. The ICO’s guidance on controllers and processors is explicit that the firm pasting client data into a third-party tool remains the controller, and the third party is acting as a processor whether or not anyone signed an agreement. The NCSC’s browser security guidance recommends an approvals process for any extension that touches business systems. Where a developer cannot point you at a Data Processing Agreement and a clear retention statement, the legal default is that your firm is processing personal data without a lawful basis. That is the same exposure that applies to chatbots, but extensions tend to slip in under the radar because there was no procurement step.
What do you do when you find an extension that should not be there?
Remove the extension first, before anything else, to stop the data flow. Then check the browser’s history and saved sessions for the period it was installed, clear cached data, and rotate passwords for any sensitive accounts the user logged into. If the developer has had a documented security incident in the last twelve months, treat any active session during that window as potentially compromised and reset its credentials.
The Cyberhaven supply-chain attack in late December 2024 is the textbook case. A trusted security extension was hijacked through an OAuth phishing attack on the developer, and the malicious version was live for around twenty-four hours over the Christmas weekend when many security teams were on holiday. The same campaign went on to compromise at least 35 extensions with a combined 2.6 million installs. A separate Microsoft Defender report in March 2026 documented malicious AI-assistant extensions reaching around 900,000 users, harvesting LLM chat content and browsing data from inside enterprise sessions.
Then have the conversation with the team member who installed it. The tone is curiosity, not reprimand. There was a real productivity reason the extension went on, and that reason has not gone away. Replacing it with a sanctioned tool, or writing a short paragraph into the firm’s minimum viable AI policy about what categories of extension are allowed, is the durable fix. If you have not got that policy yet, this audit is usually the moment to write it.
If you have done the sweep and are not sure which of the extensions on the list are worth keeping, which need replacing, or how to set the firm up so this does not happen again next quarter, book a conversation.
