Malicious AI Browser Extensions Are the New Endpoint Agent
"Summarise this page" extensions ask for read access to every tab. A wave of 2026 takeovers shows what happens when that permission changes hands.
An AI browser extension that summarises pages needs to read pages. That single permission — host access to every site the user visits — is functionally an endpoint agent with an update channel controlled by whoever owns the publisher account.
The pattern
- A small extension builds a genuine user base with a genuine feature.
- The publisher account is sold, phished, or session-hijacked.
- An update ships that adds a second network destination alongside the legitimate model endpoint.
- Page content, form values and session-scoped tokens flow out for weeks before anyone notices, because the extension keeps working perfectly.
Why detection is late
Extension traffic looks like browser traffic. It leaves from the user's own session, to a domain that is plausibly an AI provider, over TLS, at a volume that matches ordinary browsing. Endpoint tooling sees the browser process, not the extension inside it. Nothing in the flow resembles the exfiltration patterns most rules are written for.
Controls that hold
1. Allowlist, do not blocklist
Enterprise browser policy supports install allowlists. Anything not explicitly approved should not install. Blocklists are a losing game against a marketplace that adds thousands of items a week.
2. Pin the version
Force-installed extensions can be pinned. A pinned version cannot silently become a different program overnight; new versions go through review rather than auto-update.
3. Review the permission, not the feature
The approval question is not "is this a useful summariser" but "do we accept that this publisher can read every page including the payroll system". For most publishers the honest answer is no.
4. Watch the destinations
Egress from managed browsers to model endpoints should resolve to a known, approved set. A new destination appearing in that traffic is worth an alert even when the volume is small.
5. Give people a sanctioned alternative
Every unapproved AI extension in your estate is a feature request. Ship an approved one, or the shadow version wins on convenience.
An extension with read access to all sites is not a plugin. It is an unmanaged agent with a supply chain you do not control.
