The extension in the room.

Summary

Shadow AI used to mean a chatbot in a browser tab. It now includes extensions that read every page, AI assistants built into the browser itself, and agentic browsers that click and type inside logged-in sessions. All of it runs at the level of the rendered page, on the employee's device.

A proxy, CASB or network DLP tool sees that a browser opened an encrypted connection to a domain. It does not see which extension read the page, what an AI sidebar sent to its vendor, or which instruction an agent followed. The paper walks the public record from 2024 to 2026, a threat model for agentic browsers, and a policy playbook.

The numbers

• 8M+users of four Urban VPN-family extensions that captured chats on 8 AI platformsKoi Security via THN · Dec 2025
• 20,000+enterprise tenants where fake AI-assistant extensions were activeMicrosoft Defender · Mar 2026
• 53%of enterprise users had installed an extension with high or critical permission scopeLayerX · vendor report · 2025
• 11.2%prompt-injection attack success in a browser agent even after new mitigationsAnthropic · Aug 2025

Key findings

1. The threat often arrives as an update. Urban VPN Proxy began capturing AI conversations in version 5.5.0, released on 9 July 2025, with collection on by default and no toggle. It was disclosed 159 days later.
2. Impersonation works at scale. Two extensions posing as an AI sidebar reached about 900,000 users. One carried Google's "Featured" badge. Both sent chats and tab URLs to a remote server every 30 minutes.
3. GenAI extensions ask for more access. 58% have high or critical permissions, and they request the scripting API almost twice as often as the average extension (26.97% vs 14.34%).
4. Agentic browsers widen the gap. Gartner advised CISOs to block AI browsers for now (1 Dec 2025). In September 2026 a researcher showed one extension hijacking the built-in AI agents of five browsers.
5. Some attacks never touch the network. In the HashJack technique, instructions hidden in the URL fragment never leave the AI browser, so network and server defences cannot see them.

What is inside

1. 01Four forms of browser AI
2. 02Two years of incidents
3. 03Silent updates, real scale
4. 04The permission problem
5. 05What each control layer sees
6. 06Agentic browsers: a threat model
7. 07Accounts, prompts and data
8. 08What to measure on your fleet
9. 09A policy playbook