An AI usage inventory almost always produces the same list: ChatGPT, Copilot, Gemini, perhaps Claude. What rarely appears on it are the fourteen extensions installed on the same laptop, four of which have access to all sites and two of which gained an AI feature last year.
This article is about us as well, because we ship a browser extension. That makes it an awkward subject, which is exactly why it is worth writing about.
What "access to all sites" means
When you install an extension, the browser shows which permissions it requests. The broadest is access to your data on all websites. In practice, that means the extension can read the contents of every page you open, and usually change them.
That is a wider reach than most AI services have. ChatGPT sees what you type into ChatGPT. An extension with these permissions sees your webmail, your CRM, your case management system, the intranet and the field you are typing into, whatever site you are on.
No vulnerability is needed for that. It is consent someone gave once, usually within two seconds and usually with no administrator involved.
Three ways this slips out of your control
The permissions stay the same; the function changes. An extension that adjusted colours three years ago gained an AI assistant last year. Its permissions were already broad enough. Nobody was asked to approve anything again, because nothing new was requested.
Acquisitions. A popular extension is bought and the new owner inherits the installed base and the permissions. There are documented cases where that was used to add behaviour the original author never wrote, with automatic updates pushing it to everyone.
The forgotten extension. Installed for one task two years ago, quietly present ever since with full read access.
What the three have in common: the risk does not arise at installation but afterwards, and there is no point at which anyone looks again.
Why this belongs in your AI inventory
If you are mapping which AI services are in use, an extension with an AI feature is an AI service. It processes text, sends it somewhere and has a vendor behind it, with a jurisdiction and terms of its own.
So the questions are the same as for any tool: what leaves, to whom, where is that party based, what is retained and is there a data processing agreement? See approving an AI tool: what to ask the vendor.
The difference is that extensions almost never went through procurement. They arrived the way most shadow AI arrives: through somebody trying to get their work done faster.
What about us?
The BeeSensible browser extension has read access to the pages it works on. If we mean what we have just written, we owe you the same answers about ourselves.
The text you type is analysed to work out what is sensitive. It is sent to our detection service in the EU, analysed in memory and discarded straight away, without being stored. Where the organisation has analytics switched on, we record events without the values themselves: the type of data, the level, the app, the timestamp and the action. No text. When someone visits an AI tool, the extension reports only the domain, at most once per day per device, with no user ID and no page content.
That is the question you should be putting to us, and it is the same question the other thirteen extensions deserve.
Getting a handle on extensions
- Take stock. In a managed browser estate you can see which extensions are installed and what permissions they hold. Without central management you are left asking people, which gives an incomplete picture.
- Work from an allowlist. Blocking everything does not work, because people need extensions. A short approved list does, provided there is a way to get something added to it.
- Reassess when ownership changes. This is the event most often missed.
The reason to put effort into this is not that extensions are more dangerous than other software. It is that they are the only category in which the employee chooses the vendor, approves the permissions and accepts the terms, all in a single click.
