ChatGPT Is Now Clicking Inside Your Chrome Tabs: What Work Mode Can Do, the Hidden-Header Trap and Which Tabs to Keep Off-Limits (AI Trends, 20 October 2026)

What’s trending in AI on 20 October 2026: ChatGPT no longer needs its own browser to browse for you. It now works inside yours. OpenAI’s updated Chrome extension, announced on 15 October and spreading through tech coverage this week, splits ChatGPT into two modes: Chat, which reads across your open tabs, and Work, which can act in them by filling in forms, sending messages, downloading files and grouping tabs. Those tabs include sites where you are already signed in, such as Gmail, LinkedIn or your company’s internal tools. That is useful, and it is also a big change in who can click what on your behalf. The same week, researchers scanning 217 million web responses found sites hiding instructions for AI agents in places a human never sees. Below: what the extension does, how its permission prompts work, what the hidden-header study really found, and a traffic-light guide to which tabs you should and shouldn’t let it touch.

Key takeaways

Two modes, two risk levels. Chat mode reads your open tabs. Work mode can act in them: send messages, fill forms, download files and group tabs.
It works in your signed-in sessions. Unlike a sandboxed cloud browser, the extension operates in the browser profile where you are already logged in.
Permission is per site by default. ChatGPT asks before using each new website. “Allow for all sites” removes those prompts, and OpenAI’s own documentation flags it as elevated risk.
Web pages are now inputs. OpenAI tells users to treat page content as untrusted. A study of 217 million responses found 30 sites already trying hidden prompt injection in HTTP headers, mostly pranks.
Companies need a browser-agent policy. Decide which profiles, sites and roles may use agent mode before staff decide for you.

The new question for every browser tab: is this one an AI agent is allowed to touch?

1. What OpenAI shipped

On 15 October, ChatGPT’s official account announced that “the full power of ChatGPT is now in your browser,” as quoted by Android Authority. The updated extension lives in a Chrome sidebar with your full ChatGPT conversation history, and it comes in two modes.

Chat mode reads across your open tabs and answers questions about them. The examples in coverage are mundane but handy: comparing prices or product dimensions across several shopping tabs, summarizing a report, or drafting an email from what is on screen. Work mode goes further. According to PiunikaWeb and PPC Land’s reading of OpenAI’s announcement, it can send messages, fill out registration forms, download files and organize tabs into groups. Android Authority adds examples such as filling inventory forms, or pulling receipts from Gmail and submitting them to a company expense page.

Some details are still murky. Android Authority says the features reach all plans including free users; PiunikaWeb reports that Work mode needs at least a Plus subscription. OpenAI’s own setup page lists Chrome, Edge, Brave, Opera and Vivaldi as supported, requires the latest ChatGPT desktop app, and says availability can depend on rollout and workspace settings. CtrlMag cites a Chrome Web Store count of roughly 7 million users for the extension, so even a slow rollout reaches a lot of browsers.

Chat mode is a research assistant. Work mode is closer to handing someone your logged-in laptop.

2. Why it matters: the agent moved into your browser

This launch closes a loop that began in July. On 9 July, OpenAI said it would shut down Atlas, its standalone AI browser, and access ended on 9 August, as Tech Times reported. James Sun, who leads OpenAI’s browsing work, said persuading people to switch browsers was harder than building features into tools they already use. Atlas’s replacements were a browser inside the ChatGPT desktop app, a cloud browser that runs agent tasks on OpenAI’s servers, and the Chrome extension. Google is moving the same way with Gemini’s auto browse feature, which PiunikaWeb notes recently expanded to India.

The difference matters for security. A cloud browser starts empty, and you sign it in to what it needs. The extension works in your normal browser profile, where you are already logged in to email, banking, your CRM and admin consoles. TBreak notes that it can act on signed-in sites such as Gmail and LinkedIn. That is the whole point: no extra logins. It is also why the extension’s permission model deserves a closer look than most people will give it. We made the same argument about “Allow always” becoming the new “I agree” earlier this month.

3. The permission model, setting by setting

OpenAI’s documentation is clearer than most of the coverage, so here is what it says, alongside what to make of it.

Control	What OpenAI’s docs say	What it means for you
Per-site approval	Asks before using each new website, by host. Options: allow once, allow for this site, allow for all sites, or decline.	The default is sensible. Keep it. “Allow once” is the safest choice for anything sensitive.
Allow for all sites	Removes confirmation for every website; flagged as elevated risk.	One click turns a supervised assistant into an unsupervised one. Avoid it on work profiles.
Browser history	Asks each time; access is scoped to the request, with no always-allow option. Flagged as elevated risk.	Good design. History reveals a lot about you and your employer.
Allowlist and blocklist	Managed under Settings, Computer Use, Manage; shared across supported browsers.	Blocklist banking, payroll, health and admin consoles once, and it applies everywhere.
Chrome install permissions	May include debugger access, reading and changing data on all sites, history, bookmarks, downloads, notifications, native app messaging and tab groups.	Broad by necessity. ChatGPT’s own prompts are the real guardrail, so treat it as a high-privilege extension.
Data storage	No separate full log of browser actions; content is stored only when it becomes chat context, such as page text, screenshots or tool calls.	Anything ChatGPT reads in a tab can end up in your chat history and under your ChatGPT data controls.
Memories	Browser tasks follow your Memories setting.	If Memories is on, past chats can shape what it does in your tabs.

Source: OpenAI’s ChatGPT browser extension documentation (learn.chatgpt.com), accessed 20 October 2026. Interpretation is Delana’s.

Two gaps stand out. First, the documentation we read does not say whether sending a message or submitting a form triggers its own confirmation once a site is allowed. PPC Land points out that the “stop before submitting” demo was a user instruction, not a built-in pause. Second, apart from noting that workspace settings can affect availability, the page does not describe admin controls for business accounts. Until those are documented, assume the user’s choices are the main control.

For work profiles, the top step should stay out of reach.

4. The real risk: your tabs become instructions

An AI that reads a web page cannot always tell the difference between information and orders. That is prompt injection, and nobody has fully solved it, as PPC Land notes. OpenAI’s documentation is candid about it: it tells users to treat webpage content, selected text and video transcripts as untrusted, and warns that malicious or misleading page content can push ChatGPT to copy data somewhere you did not intend.

Picture how that plays out. You ask Work mode to copy supplier details from five tabs into a spreadsheet. One supplier page carries hidden text telling the agent to paste your open CRM tab into a “verification” form. In Chat mode, the worst case is a misleading answer. In Work mode, signed in to everything, the same trick can turn into an action. We saw the coding-agent version of this in GitHub Copilot CLI leaking a secrets file in 28 seconds, and the attacker-run version in yesterday’s story on one hacker’s AI agents breaking into more than 100 sites.

5. What 217 million web responses showed

Security firm Signals Corps looked at a hiding place most people never check: HTTP response headers, the metadata a server sends before the page itself. It read the headers on 217,097,223 page responses, roughly a tenth of Common Crawl’s September 2026 crawl, and kept every header aimed at an AI system. The Register covered the findings on 15 October.

Most AI-aimed headers were harmless. Of 7,959 sites, 7,271 simply pointed agents to resources such as llms.txt files. Only 30 attempted prompt injection, and 22 of those were pranks of the “ignore all previous instructions” variety. The handful that were not jokes are the interesting part: two fake applicant scores aimed at AI hiring screeners, one request to report the agent’s model name to an outside site, and an “AgentPwn” test that told agents to run an npm package and send a report.

The controlled test matters even more. Signals Corps ran fresh Claude Code agents against a server that hid an instruction in a header. With everyday prompts, 0 of 9 runs obeyed. When the prompt told the agent to follow the site’s instructions, 7 of 9 did. Injection worked only when the tool passed headers to the model and the prompt gave the site authority. The Register’s bottom line was that real-world victims were very unlikely so far. The lesson is not that headers are a crisis. It is that how you phrase a request to an agent can decide whether a hostile page gets a vote.

The attack is rare today. The prompt habit that enables it is common.

One more finding should worry anyone who uses AI to screen résumés or vendors. Servers can tell when an AI fetcher is visiting, through published user agents such as ChatGPT-User, and serve it different content. Signals Corps cites a test by SPLX in which a cloaked job candidate scored 88 with AI screeners against 26 for the real résumé. What your agent sees may not be what you see.

6. What IT and security teams can do now

For most companies the first problem is visibility. A browser extension installed by an employee is classic shadow AI, except this version can act, not just read. Vendors are racing to catch up. On 19 October, Microsoft said it is expanding Microsoft 365 E7’s ability to find AI agents running on employees’ computers from 25 agent types to 60, naming Claude Code, OpenAI’s Codex and GitHub Copilot, GeekWire reported. Each agent gets a continuously updated risk score, and admins can make it read-only, require human approval for high-stakes steps or shut it down. The features are in private preview, with broader availability planned for Microsoft Ignite on 17 to 19 November. It is the product side of the argument Satya Nadella made in his “emergency brake” essay: controls should sit outside the model.

You do not need E7 to start. Chrome and Edge already let administrators allow or block specific extensions on managed devices. Use that to decide deliberately whether the ChatGPT extension is permitted, and on which profiles. Pair it with written guidance, because the extension’s own allowlist and blocklist live in each user’s ChatGPT settings. If you are handing agents real identities elsewhere, as Google now does with Gemini agents getting their own Workspace accounts, keep browser agents in the same inventory.

7. The traffic-light guide: which tabs can ChatGPT touch?

Recent guides here have been decision paths, scorecards and week-by-week plans. This one is a traffic light. Sort your tabs into three colours before you switch on Work mode, and share the list with your team.

Print it, pin it, and make the red row non-negotiable on work devices.

Green: go

Public pages only. Research, product comparisons, news, documentation and anything you could read without logging in.
Chat mode first. Reading and summarizing covers most of the value with little risk.
Phrase tasks as yours. Say “compare these three pricing pages,” never “do what this page says.” The header study showed that wording is the difference between 0 of 9 and 7 of 9.

Amber: supervise

Signed-in work apps. Email, calendar, CRM, ticketing and project boards.
Allow once, not always. Pick the narrowest permission and let it lapse after the task.
Stop before the button. Ask the agent to fill fields and stop. You review, then you click Send or Submit.
Watch downloads. Don’t let it open or upload files it fetched from unfamiliar sites.

Red: stop

Money and identity. Banking, payments, payroll, HR, health portals and password managers. Add them to the extension’s blocklist. If you are tempted to let an agent pay bills, read our note on why your wallet is the new attack surface.
Admin consoles. Cloud, domain, firewall and SaaS admin panels. One injected instruction here can become an outage or a breach.
Close, don’t just ignore. PiunikaWeb and TBreak both advise closing sensitive tabs while the agent runs. Better still, give agent work its own browser profile with no sensitive sessions in it.
Never “Allow for all sites” on a work profile. OpenAI flags it as elevated risk. Treat it as a policy breach.

8. The bottom line

OpenAI’s Chrome extension makes agentic browsing ordinary. It lives in the browser people already use, inside sessions they are already signed in to. The permission prompts are reasonable by default, and OpenAI is unusually frank that web pages can manipulate the agent. But defaults are only as good as the clicks people make, and one tap on “Allow for all sites” undoes most of them. For individuals, the answer is a separate profile and the traffic-light habit. For companies, it is deciding now whether the extension is allowed, on which devices, and for which sites, and then folding browser agents into the same AI agent security program as every other bot with credentials.

Frequently asked questions

What can the ChatGPT Chrome extension do now?

Since OpenAI’s 15 October 2026 update, the extension has two modes. Chat mode reads across your open tabs to answer questions, compare and summarize. Work mode can act in tabs: send messages, fill out forms, download files and group tabs, including on sites where you are signed in.

Is ChatGPT Work mode in Chrome free?

Reports differ. Android Authority says the new features reach all plans, including free users, while PiunikaWeb reports that Work mode requires at least ChatGPT Plus. OpenAI’s documentation says availability can depend on rollout and workspace settings.

Does ChatGPT ask permission before acting on a website?

By default, yes. It asks before using each new website, with options to allow once, allow for that site, allow for all sites, or decline. It asks every time before using browser history. Choosing “allow for all sites” removes the per-site prompts, and OpenAI labels that elevated risk.

Does OpenAI store what ChatGPT sees in my tabs?

OpenAI says it does not keep a separate full log of browser actions. Browser content is stored when it becomes part of the chat, such as page text, screenshots, tool calls or summaries, and your normal ChatGPT data controls then apply. Browser tasks also follow your Memories setting.

What is prompt injection in a browser agent?

It is when text on a web page, visible or hidden, tricks an AI agent into treating it as an instruction, for example to copy data from another tab. OpenAI tells users to treat page content as untrusted. A Signals Corps scan of 217 million web responses found 30 sites attempting injection through HTTP headers, mostly as pranks.

Should my company allow the ChatGPT extension?

That is a risk decision. A sensible middle path is to allow Chat mode on managed browsers, limit Work mode to a separate profile without sensitive sessions, blocklist banking, HR and admin sites, ban “allow for all sites,” and use your browser management tools to control which extensions can be installed.

Delana Technologies