AI browser extensions are quietly becoming a corporate data exfiltration risk
Nearly every employee at nearly every company now has at least one AI browser extension installed — a writing assistant, a meeting summarizer, a research copilot, a coding helper. A 2026 study found that 99% of enterprise users have at least one browser extension, and almost 75% of those extensions request high or critical permission levels. That combination — near-universal adoption plus broad access — has quietly created one of the largest unmanaged attack surfaces in the modern enterprise.
The problem isn't hypothetical. In January 2026, researchers at OX Security uncovered two Chrome extensions impersonating popular AI assistants that had exfiltrated complete ChatGPT and DeepSeek conversation histories from more than 900,000 users. In April, Palo Alto Networks' Unit 42 identified 18 separate high-risk AI browser extensions actively surveilling emails, intercepting AI prompts, and harvesting passwords. In July, Google pulled ModHeader — a utility extension trusted by 900,000 users for years — after discovering hidden surveillance code had been quietly pushed through an update.
Why AI Extensions Are Structurally Riskier
The risk isn't that AI extensions are more likely to be built by bad actors than ordinary extensions — it's that their core function requires the kind of access that used to be reserved for the most privileged browser tools. To summarize a webpage or draft a reply inside Gmail, an AI extension typically needs to read the full DOM, which means it can see cookies, session tokens, and anything typed into a form field. Security research from LayerX found that AI-branded extensions are three times more likely to request cookie access and 2.5 times more likely to have scripting permissions than non-AI extensions — permissions that, in the wrong hands, allow code injection and keystroke capture.
Layer onto that the fact that many of these extensions are built by small teams or single developers, with none of the code-review rigor a Fortune 500 vendor would apply. An extension that ships clean can become dangerous later: a compromised developer account, or a single malicious update, can push new data-collection behavior to a million installed browsers without any re-consent prompt for the end user.
The New Wrinkle: Agentic Extensions
The threat model has also expanded beyond passive data collection. A growing class of “agentic” AI browser extensions doesn't just read pages — it acts on them, filling forms, clicking through multi-step workflows, and executing tasks with the user's full authenticated session. Security researchers have already demonstrated a technique dubbed “CursorJacking,” where a malicious extension piggybacks on an AI coding assistant to quietly exfiltrate API keys, proprietary source code, and chat logs. When an extension can both read your session and act within it, indirect prompt injection — content embedded in a webpage designed to manipulate the AI's next action — becomes a viable attack path into internal tools, not just a novelty.
Why Traditional Tools Miss It
The security stack most enterprises already have — Data Loss Prevention, Cloud Access Security Brokers, Endpoint Detection and Response — was largely designed around network traffic and file movement, not DOM-level behavior inside the browser runtime. A DLP tool watching for a file upload to an unauthorized destination won't necessarily flag an AI extension quietly reading text out of a form field and sending it to a third-party inference API in a background request. That gap is why Akamai's 2026 corporate AI risk report singles out “shadow AI” — tools adopted by employees without security team visibility — as a distinct and growing exposure category, separate from the sanctioned AI tools IT departments have already vetted.
What Actually Closes the Gap
The fix isn't banning AI extensions outright — that ban would be circumvented within a week and would cost real productivity. What's proving effective in 2026 deployments is a narrower set of controls: allowlist-based installation policies that require security review before an extension reaches a managed browser, per-extension permission auditing that flags scope creep on updates, and enterprise browser management platforms that can see DOM-level activity rather than just network flows. A formal AI Acceptable Use Policy — naming which categories of extension are pre-approved, and which require a request — closes the ambiguity that lets shadow AI spread in the first place.
For IT and security leads: the practical starting point is an extension inventory audit this week, not next quarter. Pull the list of every extension installed across managed devices, cross-reference permission levels against the LayerX and Unit 42 findings above, and prioritize review of anything with cookie or scripting access installed outside a formal approval process. The vulnerability rate for AI-branded extensions — 60% more likely to carry a known CVE than non-AI extensions, per recent research — means the extensions already sitting in your employees' browsers are a live risk, not a future one.