How to Stop AI Browser Extensions Leaking Company Data
AI assistants built into Chrome, Edge and Brave, and the extensions employees add on top, can read the full content of whatever tab they're pointed at — an internal wiki page, a customer record, an emailed contract — and summarize, forward or act on it, often without the user realizing the AI has seen the whole page rather than just what they typed. The fix is policy enforced on the machine itself, restricting what domains and data the agent can read and where it can send output, rather than relying on employees to remember not to use it on sensitive pages.
What "AI in the browser" actually has access to
Browser-based AI isn't limited to a chat sidebar that only sees what you paste in. Assistants built into Chrome, Edge and Brave, along with third-party extensions, are commonly given access to the full DOM of the current page — meaning they can read everything rendered there, including content the user never selected: an internal dashboard, a support ticket with a customer's personal data, an admin console, or an email open in another tab. Some go further and can act on a page: click buttons, fill in forms, navigate to links. That's useful for summarizing a long document or drafting a reply, and it's exactly the same capability that turns a browser AI into a data-exfiltration path or an unsupervised actor on internal systems.
The three ways this goes wrong
Unintentional leakage. An employee asks the assistant to "summarize this page" without thinking about what's on it. The assistant sends the page content to a cloud service for processing. If that page contained a customer list, source code, or financial figures, that content has now left the company's control, independent of any malicious intent.
Indirect prompt injection on the page itself. A web page can contain text designed for the AI reading it, not the human — hidden in white-on-white text, in an HTML comment, or in alt text. If an agent with the ability to act (click, submit, navigate) is reading that page, injected instructions can tell it to submit a form, visit another URL, or paste something somewhere, without the user asking for any of that.
Shadow extensions. Employees install AI browser extensions directly from the web store because they're useful, not because IT approved them. Each one has its own data-handling practices, its own permissions, and its own blast radius, and most organizations have no inventory of which laptops have which ones enabled.
Why "ask employees not to" doesn't scale
A policy that says "don't use the browser AI on sensitive pages" depends on every employee correctly judging, every time, whether a page is sensitive — across hundreds of internal tools, SaaS admin panels and shared documents. It also does nothing about injected instructions on a page the employee had every reason to trust, and nothing about extensions that were never evaluated in the first place.
What actually needs governing
| Surface | Example | What needs to be true |
|---|---|---|
| Built-in browser AI | Assistant features shipped inside Chrome, Edge or Brave | IT can see it's active and set where it's allowed to read |
| Third-party extensions | AI summarizer or "agent" add-ons from the web store | IT has visibility into which machines have which ones installed |
| Agentic browsing | An assistant that clicks and navigates on the user's behalf | Actions, not just reads, are checked against policy |
| Desktop AI apps with browser reach | Claude Desktop or similar reading open tabs | Same domain and data rules apply as in the browser itself |
Where the control needs to live
The practical answer is a policy layer that runs locally on the laptop, sees which AI surfaces are active across Chrome, Edge, Brave and desktop apps like Claude Desktop, and enforces rules about what domains and content those agents can read and where their output can go — set once by IT and applied the same way on every machine, rather than left to each employee's judgment in the moment. That's also what makes the setup auditable: a security team can see what was blocked and why, instead of finding out after a leak that an assistant quietly read a page it shouldn't have.
DriftLock's desktop app and Console are built for exactly this: policy enforced locally across the browsers and AI tools already on a company's laptops, with one place to set and review that policy across the fleet.
What to take away
- Browser AI commonly sees the whole page, not just what a user types into it — that includes internal tools and documents the user never meant to share.
- A web page can carry instructions aimed at the AI reading it, not the human, which is a risk independent of what the employee asked for.
- Unapproved extensions create exposure IT can't see, because there's no inventory of what's installed where.
- Relying on employees to judge sensitivity page-by-page doesn't scale across a company.
- Policy enforced locally and set centrally is what turns this from a hope into something you can audit.
