If your employees run the ChatGPT extension in Chrome, an OpenAI agent can now click, type and send inside Salesforce, Gmail and your internal tools with their live sessions. OpenAI does not keep a complete record of what it did there. The site-by-site permission belongs to the user unless you set workspace policy. Each employee can click "Allow for all sites" without asking anyone. This week you have to decide whether the extension is allowed on managed browsers, which hosts it may never touch, and what you will rely on for evidence when someone asks what the agent changed.
OpenAI shipped the update on October 15. The Chrome Web Store listing shows version 1.26.1005.11759, last updated that day, with 7,000,000 users and a 1.9 rating from 985 reviews. The Decoder reports that the updated extension "works with all ChatGPT plans," so free and Plus accounts can install it too, outside your workspace policy. OpenAI's own documentation adds that availability "can depend on rollout and your workspace settings."
What the Extension Can Now Do in Your Tabs
The extension has two modes, and the second one acts. The Decoder describes Chat mode pulling data from several tabs at once, while Work mode controls tabs through Computer Use. 9to5Google puts it as "ChatGPT can control your Chrome tabs to get things, like sending messages, filling out forms, or downloading files." It can also group and reorganize tabs from a sidebar that sits beside the page.
The part that matters for security teams is where it acts. Unite.AI's write-up notes the extension works on sites where the user is already signed in, naming LinkedIn, Salesforce, Gmail and internal tools. Computer use, in this context, means a model that operates a graphical interface the way a person does: it reads the screen, then clicks and types. In a logged-in tab it does that with the user's full session, which no API scope or OAuth consent screen narrows.
The install prompt is wide. Per the same Unite.AI piece, Chrome's install-time permissions for the extension can include reading and changing data on all websites, browsing history, downloads, tab groups, debugger access and communication with native applications. OpenAI's extension documentation acknowledges this and says ChatGPT "still uses its own confirmations, settings, allowlists, and blocklists" on top of those browser permissions. Your control therefore depends on OpenAI's settings layer, unless you impose Chrome's own.
OpenAI has already retired one browser product. Unite.AI recounts that OpenAI announced the deprecation of its Atlas browser on July 9, 2026, with Atlas scheduled to stop working on August 9. The capability now arrives as an extension in the browser your fleet already runs, where an existing "block unapproved browsers" rule does not catch it.
Who Decides Which Sites the Agent Touches?
By default the user decides, one host at a time. The OpenAI docs say ChatGPT asks before using each new website, keyed on the host, and offers "Allow once," "Allow for this site," "Allow for all sites" and "Decline." The user manages the resulting allowlist and blocklist under Settings > Computer Use > Manage in the desktop app. OpenAI labels "Allow for all sites" as Elevated Risk because it removes the per-site prompts entirely. Browser history is also Elevated Risk, is requested every time and has no always-allow option.
Look closely at what the prompt covers. It asks about a website, not about an action. Once a user picks "Allow for this site" on your CRM, nothing in that documentation describes a separate confirmation before the agent edits a record or sends a message there. OpenAI's own sample prompts tell the agent to fill a registration form "and stop before submitting," which PPC Land points out suggests the stop is something the user has to ask for. We covered the same per-origin design in OpenAI's hosted browser agent, which also approves once per site.
For ChatGPT Enterprise, administrators can take the decision back. OpenAI's ChatGPT Work local security page lists a features.browser_use_external = false setting that "disables agent-driven Browser Use through supported browser extensions." Managed Browser Use policies can restrict site access, uploads, downloads, browser-history access and full Chrome DevTools Protocol access, and administrators can limit how long a site approval lasts. The line your security team wants is there too: "A user approval cannot override an administrator's denial." The admin rollout guide shows these [features] keys, and the security page says enforced requirements defined in requirements.toml "cannot be overridden by individual users."
Those policies stop at the workspace boundary. They govern ChatGPT sessions signed into your Enterprise workspace. An employee who signs the same extension into a personal Plus account on a managed Chrome profile is outside them, and only Chrome policy reaches that case.
What OpenAI Does Not Record
OpenAI says plainly that its record is incomplete. The extension docs state: "OpenAI doesn't store a separate complete record of your browser actions from the extension." Browser activity is stored only when it becomes part of the ChatGPT conversation, such as text read from a page, screenshots or tool calls. A click the model made without describing it may leave no trace on OpenAI's side.
The enterprise documentation repeats this for compliance. The local security page says "OpenAI does not store a separate complete record of Chrome actions performed through the extension," and that Compliance API records cover "supported cloud records" rather than every local browser action. Browser Use can emit OpenTelemetry events for capability checks (site access, uploads, downloads), recording the decision and its source, but OpenAI warns the source "can be unknown" and that "these events do not establish a complete record of every browser or native-app action." It adds that audit logs and compliance exports "do not block processing on their own."
There is a second gap in the same page. When ChatGPT drives a browser through native Computer Use instead of the extension, "Browser Use's site and capability policies do not apply to this path." That is a separate features.computer_use setting, with its own per-application rules. If you lock down the extension and leave native Computer Use on, the agent can still reach Chrome as an application.
So your evidence has to come from the target systems. Salesforce's field history, Google Workspace's Gmail log events and your internal app's own audit table will show changes made under the employee's identity, and none of them will distinguish the person from the agent. We saw the same attribution problem in OpenAI's Dots beta, which also skipped your OTel collector.
Why Logged-In Agents Draw Security Teams' Worst Case
The worry is prompt injection with a live session attached. Prompt injection is text planted in content the model reads (a web page, an email, a comment) that the model then follows as if the user had typed it. OpenAI's own docs tell users to treat page content, selected text and video transcripts as untrusted, and to avoid putting secrets into browser tasks unless they can review each prompt.
The industry has already seen how this plays out. On August 20, 2025, Brave published an attack on Perplexity's Comet in which hidden instructions in a Reddit comment led the assistant to pull the user's email address, trigger a one-time-password login, read the code from the user's logged-in Gmail and post both back to the attacker. Brave's conclusion was that same-origin policy and CORS "are all effectively useless" once an agent acts with the user's authenticated privileges.
OpenAI has not claimed to have solved it. When it hardened Atlas in December 2025, it wrote that prompt injection "is unlikely to ever be fully 'solved,'" as TechCrunch reported, and a spokesperson would not say whether the update measurably reduced successful injections. In the same piece, Wiz's Rami McCarthy framed the risk as "autonomy multiplied by access," and put agentic browsers at "moderate autonomy combined with very high access." Anthropic has published numbers for its own Chrome agent, a 23.6% attack success rate across 123 test cases falling to 11.2% with mitigations, per PPC Land, which notes OpenAI has published no comparable figure for this extension.
The strongest case for allowing it is that the agent saves real time on dull cross-tab work, the per-site prompt is a meaningful brake, and a ban pushes users to personal devices you see even less of. Gartner took the opposite view. Its December 2025 note, covered by CSO Online, told organizations to "block all AI browsers for the foreseeable future," with small low-risk pilots allowed for higher risk tolerance. Analyst Evgeny Mirolyubov warned that "the loss of sensitive data to AI services can be irreversible and untraceable." An extension in Chrome gives you more levers than a separate browser did, and that is the case for governing rather than banning. Financial institutions are already drawing the line at money movement, as Schwab and JPMorgan did with outside agents.
How Chrome Policy Closes the Gaps OpenAI Leaves
Chrome's own extension policy works regardless of which ChatGPT account the user signs into. Google's ExtensionSettings documentation lets you set installation_mode per extension ID: blocked stops installs, and removed (Chrome 75 and later) blocks installation and uninstalls copies already present. The ChatGPT extension's ID is hehggadaopoacecdllhhajmbjkdcmajg, from its store URL.
If you allow it, runtime_blocked_hosts blocks an extension from modifying the sites you list, including JavaScript injection, cookie access and web-request changes. The cap is 100 entries per field, and Google's page says "additional entries are discarded," so put your crown-jewel hosts first: the CRM, the ERP, the payroll and banking portals, the admin consoles. Because this extension also requests debugger access, test the block on a pilot profile against each listed host before you rely on it. We found an agent product that ignored its own allowlist in Google's Antigravity, and the lesson was to test enforcement rather than read the settings page.
Layer the two. Chrome policy decides whether the extension runs and where it can never act, for every account. Workspace policy decides, for Enterprise accounts, which sites the agent may use, whether uploads and downloads are allowed and how long approvals last. The OpenTelemetry stream records those decisions, and the target system's audit log records the result.
What to Do Before Employees Click Allow for All Sites
This Week:
- Pull your Chrome extension inventory from the admin console and count managed profiles with
hehggadaopoacecdllhhajmbjkdcmajginstalled. That number tells you whether this is a policy question or already an incident-response question. - Decide allow, govern or block, and write it down. If you block, set
installation_modetoremovedso existing installs come off too. - If you govern, publish a
runtime_blocked_hostslist of no more than 100 hosts, starting with systems that move money, change customer records or hold regulated data. - In ChatGPT Enterprise, set Browser Use site rules with a default of Block plus named Allow exceptions, and make them enforced requirements so users cannot change them. Check native Computer Use separately, since the browser site rules do not cover it.
This Month:
- Send Browser Use OpenTelemetry events to your SIEM and alert on approvals for hosts outside the exception list.
- Ask the owners of your top five SaaS apps how they would tell an agent action from a human one in their audit logs. Where the answer is "we can't," keep that app on the block list.
- Run a prompt-injection test on a pilot profile: plant instructions in a page or email the agent will read and see whether it follows them inside an allowed site.
Before Renewal:
- Ask OpenAI in writing for a complete per-action record of extension activity in the Compliance API, and for a per-action confirmation setting for writes on allowed sites. Both are absent from today's documentation.
The Bottom Line
The extension puts a computer-use model inside the browser profile that already holds your employees' sessions, on every ChatGPT plan, with per-user site approval as the default. The controls to contain it exist: Chrome's ExtensionSettings and OpenAI's enforced Browser Use requirements. Neither one is on by default.
RPA went through this a decade ago. Bots ran under shared human credentials, and audit teams later had to rebuild which actions were the bot's from application logs. The difference this time is that the "bot" decides what to click from text it reads on the page. Set the host block list before you set the pilot group.
Continue Reading
- OpenAI's Hosted Browser Agent Asks Once Per Site, Not Per Purchase
- OpenAI's Dots Beta Skips Data Residency and Your OTel Collector
- Schwab and JPMorgan Block Outside AI Agents From Moving Money
- Antigravity's Allowlist Isn't Honored. Use Your Proxy.
- SalesBleed Turned a Public Web Form Into an Agentforce Data Leak
- Browserbase vs Playwright vs Computer Use: The Script Still Wins