How to check whether a browser extension can read what you tell an AI chatbot

A browser extension asking to 'read and change all your data on all websites you visit' used to mean it could see what you typed into a search box. Now it can mean it's reading what you told an AI chatbot and what the chatbot told back -- and in the worst 2026 disclosures, that a completely unrelated extension could reach into your browser's own built-in AI agent and make it act on an attacker's instructions instead of yours. Two incidents this year show what that actually looks like, and a five-minute check catches both.

Two different ways this goes wrong

The first is the simpler one: an extension that just lies about what it is. In January 2026, OX Security researcher Moshe Siman Tov Bustan found two Chrome extensions impersonating a real AI-sidebar tool called AITOPIA -- one, with over 600,000 installs, even carried the Chrome Web Store's own 'Featured' badge. Both quietly captured every prompt and reply from ChatGPT and DeepSeek sessions, plus the full URL of every open tab, and sent it to an attacker's server every 30 minutes. Combined, the two extensions had roughly 900,000 users. Google confirmed the report was 'in review' the day after OX Security disclosed it; the extensions were still live at that point.

The second is stranger, and doesn't require installing anything that calls itself an AI tool at all. Security researcher Gal Weizman published BragJack on Sept. 16, 2026, showing that a single already-installed browser extension -- any extension with broad enough permissions, not one built to look like an AI product -- could hijack the browser's own built-in AI agent in Chrome, Edge, Comet, Opera Neon, and Claude for Chrome, forcing it to execute a complete attacker-written prompt with no further clicks -- the full technical breakdown of how the bypass worked is here. ("Prompt forcing," Weizman's name for the technique, is different from prompt injection -- it doesn't need the AI to be reading a hostile webpage at all.) Google and Microsoft shipped fixes and assigned CVEs; Opera disputes how Weizman found the bug in its browser.

What actually changed, and what you should check anyway

Google patched the underlying WebView flaw (CVE-2026-0628, severity 8.8) in Chrome 143.0.7499.192, released in January 2026 -- before BragJack was even publicly disclosed, because Weizman reported it privately first. Microsoft's Edge fix (CVE-2026-55945) shipped in Edge 150.0.4078.48. If your browser updates itself automatically, you likely already have both fixes. The AITOPIA clones are a different kind of problem: Chrome eventually stripped the bigger one's Featured badge, but badges describe the developer's track record, not what any specific version of the code actually does -- the fake AITOPIA extensions passed that bar for months before anyone caught them.

None of this requires waiting on a vendor. Both incidents share the same underlying weakness: broad permissions granted to an extension nobody has actually looked at closely since the day it was installed. Here's the check, and it takes about five minutes per extension you're unsure about:

Step two points at a real question: how far should site access actually go for something you're keeping?

Whichever setting applies, the same four mistakes are what actually let either 2026 incident happen in the first place.

None of this means an AI-connected extension is inherently unsafe -- most people running one have had no problem. It means the two checks that actually catch trouble -- what does this thing say it does, and does its permission list match -- take less time than reading this guide did, and unlike a store badge, they're a check you're actually running yourself. The same logic applies to giving an AI agent standing access to your inbox and calendar: connect narrow, then verify, not trust and forget.