The AI browser add-on that can read your inbox

Someone on the team installed an AI assistant into their browser. The pitch was reasonable — it summarises long pages, drafts replies, tidies up your inbox — so during setup they clicked through the permission prompts and granted it access to their email and documents. It works well, they like it, and nobody else gave it a second thought.

Here’s the awkward part. That assistant reads web pages and acts on your behalf, and it can’t reliably tell the difference between a page you asked it to summarise and a page that contains instructions aimed at it. An attacker can bury text in a web page or an email — invisible to you, plain to the assistant — that says, in effect, “find the latest invoice and email it to this address”. The assistant, helpfully, does as it’s told. No link was clicked, no password was phished. The permission you granted for convenience became a permission someone else could quietly steer.

This is the quiet failure: not a dramatic break-in, but an over-permissioned helper that nobody vetted, doing exactly what it was told by the wrong person.

Why it stays invisible

The trick that makes this work is called prompt injection — hiding instructions in content the assistant reads, so it treats an outsider’s commands as if they came from you. It’s invisible for two reasons.

First, the malicious text is usually hidden — white text on a white background, an off-screen element, a comment in an email’s code — so a human skimming the same page sees nothing wrong. Second, the assistant carries out the instruction using your access, in your session, so from the system’s point of view it’s just you, doing normal things. There’s no failed login to flag, no new device to alert on. And nobody is promising a clean patch: OpenAI’s own security chief has called prompt injection “a frontier, unsolved security problem”, the company has since written that it is “unlikely to ever be fully solved”, and its answer — a Lockdown Mode for ChatGPT, introduced in February 2026 — works by switching capabilities off rather than by making the attack impossible. That’s because reading untrusted content and acting on your behalf are, at some level, the same capability.

So the failure hides in plain sight. The real exposure isn’t the clever attack; it’s the quiet fact that an assistant nobody assessed is holding broad access to your mail and files, waiting for a page like that to come along.

Find it yourself

You can audit exactly which add-ons can reach your data in about ten minutes. Do this on each machine and browser where someone’s installed one.

Check the browser’s own extensions:

1. In Chrome, click the three-dot menu, then Extensions → Manage extensions (or type chrome://extensions into the address bar); Edge is the same shape under its … menu (edge://extensions). In Safari, choose Safari → Settings → Extensions. In Firefox, open the menu and choose Add-ons and themes. The labels drift a little between versions, but the extensions list is always a couple of clicks from the browser’s main menu.
2. For each AI or assistant-type add-on, open its Details and read its permissions — phrases like “Read and change all your data on all websites” mean it can see everything you see, including your webmail.
3. Anything you don’t recognise, or that nobody uses any more, is a candidate for removal.

Check what it was granted on the account side. Many assistants connect to your mail or documents through a sign-in grant that lives with your Google or Microsoft account, separate from the browser:

• Google: go to myaccount.google.com → Security → Your connections to third-party apps & services, and look for anything AI- or assistant-shaped with Gmail or Drive access.
• Microsoft: go to myapps.microsoft.com → Manage your apps, or your account’s Apps with access view.

You’re looking for the same three things each time: assistants you don’t recognise, ones no one uses now, and ones holding far more access than their job needs — a page-summariser that can read all your mail, say.

The fix

The goal is to make sure any assistant that reads untrusted web content holds the least access it can, and that granting it access is a decision someone actually made.

Remove what isn’t earning its keep. Any AI add-on that’s unused, unrecognised, or wildly over-permissioned: remove it, or revoke its account access, now. If something legitimate needed it, you’ll find out quickly and can re-grant deliberately — which is the point.

Right-size what stays. For assistants you keep, prefer ones that let you scope access narrowly — a single mailbox rather than the whole account, read-only rather than send-on-your-behalf. The less an injected instruction can reach, the less it can do.

Decide who’s allowed to install them. The reason these appear unvetted is that anyone can install an extension and click through its prompts alone. Agree a simple rule for your team: AI tools that touch mail or documents get a quick look by someone before they go on. In a managed Google or Microsoft setup, you can require admin approval for apps requesting high-risk access, turning a silent individual decision into a visible one.

Be honest about the limit. Turning down permissions reduces the blast radius; it doesn’t make prompt injection impossible. Treat an AI assistant with inbox access the way you’d treat a new member of staff with the same access — useful, worth having, and not something you hand the keys to without a moment’s thought.

None of this requires banning the tools. It requires deciding, once, that an assistant which can read your inbox deserves the same glance you’d give anyone else who could — and then giving it.