Are Chrome Extensions Safe? How to Check a ChatGPT Extension Before You Install (2026)

Chrome extensions are safe only when you can verify who publishes them and their permissions match what they do, and for a ChatGPT extension that matters more, because any extension with access to chatgpt.com can read your conversations. The Featured badge is not proof: in January 2026 LayerX found 16 fake "ChatGPT Mods" extensions, one of them Featured, that copied the ChatGPT session token out of the page and sent it to an attacker's server.

Disclosure: the author, Adi Leviim, is Co-Founder at Infi Developments, the company behind the AI Toolbox extension. This guide covers how to judge any ChatGPT extension, and it applies the same tests to ours, including the parts that are broad. For the safety of ChatGPT itself, see our separate guide.

By Adi Leviim, Co-Founder at Infi Developments. 7+ years building AI productivity tools. Last reviewed October 28, 2026 against Google's Chrome Web Store Help and Chrome extension documentation, OpenAI's ChatGPT browser extension page, the OX Security, LayerX, Koi Security and Guardio Labs reports, and the AI Toolbox 5.0.58 manifest.

Is It Safe to Use a ChatGPT Chrome Extension? What OpenAI and Google Say

OpenAI publishes its own ChatGPT browser extension, which connects Chrome, Edge, Brave, Opera or Vivaldi to the ChatGPT desktop app. Its documentation on ChatGPT Learn lists the Chrome permission prompt, which includes "Read and change all your data on all websites" and "Access the page debugger", and says these permissions "make it capable of operating browser workflows." OpenAI also tells users to treat page content as untrusted context. In other words, broad permissions alone do not make an extension unsafe; the publisher behind them does.

Google's position is equally short. Its Install and manage extensions page says: "Make sure you only approve extensions that you trust." If you turn on Safe Browsing's Enhanced protection, Chrome warns "This extension is not trusted by Enhanced Safe Browsing" for extensions from developers who have not yet built a track record under the Chrome Web Store policies, which Google says generally takes a few months for new developers.

Malicious ChatGPT Browser Extensions: What Has Actually Gone Wrong

These are the incidents we could read about directly from the researcher or a security publication. Every figure below comes from that source.

Two patterns stand out. First, none of these exploited a bug in ChatGPT; LayerX notes they simply used the permissions users granted. Second, the LayerX names were "ChatGPT bulk delete", "ChatGPT export", "ChatGPT folder" and "prompt manager", the same features legitimate tools offer. A useful feature name tells you nothing about who wrote the code.

How to Check a ChatGPT Extension Before You Install It

1. Find the publisher, not the name. On the Chrome Web Store listing, open the developer section and look for a real company, website and contact address. Google's badge documentation says the Established Publisher badge means the publisher verified its identity and has a positive track record.
2. Read the Featured badge for what it is. It says "Follows recommended practices for Chrome extensions." That is a quality signal. Three of the four incidents above involved a Featured listing.
3. Open Privacy practices. Since January 2021 every listing shows developer-provided data disclosures (Chromium Blog). They are self-declared, so compare them with the linked privacy policy: does it say what leaves your browser and where it goes?
4. Check Updated and Version. An AI extension that has not been updated in a year probably breaks on ChatGPT's current interface; one updated weekly is maintained, which is good, but also means code changes often.
5. Sort reviews by most recent. Old five-star reviews can sit on top of a listing that changed owners or behaviour last month.
6. Read the permission prompt before you click Add extension. If a folder tool asks to read data on all websites, ask why it needs more than chatgpt.com.

What the Permission Prompt Actually Means

Chrome shows warnings for some permissions and not others. The wording below is from Google's permissions list.

The quiet ones matter. Session tokens travel in request headers, and the webRequest permission that can see them adds no warning beyond the site access you already granted.

How to Limit What an Installed Extension Can Reach

1. Type chrome://extensions in the address bar and press Enter.
2. On the extension's card, click Details.
3. Under Site access, Google's help names three choices: On select (labelled On click in some Chrome versions), On specific sites, and On all sites.
4. For a ChatGPT-only tool, choose On specific sites and add https://chatgpt.com. Choose On click for tools you use occasionally.
5. Leave Allow in Incognito and Allow access to file URLs off unless you need them.

Google notes that these settings do not change network access for extensions that work through VPN or proxy settings, which is worth remembering given the Urban VPN case.

How to See Where an Extension Sends Your Data

1. Open chatgpt.com, press F12 (Cmd+Option+I on Mac) and select the Network tab.
2. Use ChatGPT normally for a few minutes and scan the Domain column for anything that is not ChatGPT, OpenAI or a domain the extension's privacy policy names.
3. For requests from the extension's background, turn on Developer mode in chrome://extensions and click the link next to Inspect views (as described in Google's debugging guide), then watch its Network tab.

This catches obvious cases, not patient ones: the OX extensions sent data in batches every 30 minutes.

How to Remove an Extension and Secure Your ChatGPT Account

1. In chrome://extensions, click Remove on the extension, then confirm.
2. In ChatGPT, open Settings, Security, and click Log out all. OpenAI says other sessions can take up to 30 minutes to end (OpenAI Help Center). It is OpenAI's way to end every active session at once.
3. If the extension had access to all sites, change passwords for important accounts. Malwarebytes also advises clearing cookies after the Urban VPN case.

What AI Toolbox Itself Can Access

Here is the store build of our extension (version 5.0.58, the manifest.json in the release), with each entry in plain words. It is Featured on the Chrome Web Store, which, as shown above, you should not treat as proof.

The broad part, stated plainly: webRequest plus chatgpt.com access means the extension can see the token that opens your ChatGPT account, the same thing the LayerX extensions stole. The difference is where it goes. In our code, authenticated requests are refused unless the host is chatgpt.com, chat.openai.com or our API, and since version 5.0.54 the token is shown to our server once per session to verify your account, after which the extension uses a short-lived AI Toolbox session that works only with our server. If that session cannot be opened, the extension falls back to sending the ChatGPT token with requests to our API, as older versions did. Our privacy policy says the token is not stored. We stopped requesting ChatGPT request bodies entirely; on Claude we read only the body of the bulk delete request, which holds chat IDs.

What stays local, what syncs, what leaves:

• The searchable copy of your conversations stays in your browser (IndexedDB).
• Synced to our servers: folder names and the chat IDs in each folder, saved prompts, smart-tag rules, tags, pins, favourites, message labels, bookmarks with a message snippet of up to 300 characters, and usage statistics such as message and character counts.
• Message text leaves your browser in three cases: that bookmark snippet; the AI summary for Context Mentions (3 a day on the free plan, unlimited on Premium) and context handoff, where our backend calls an OpenAI API model and does not keep the text; and PDF export (Premium or Lifetime; the free plan exports one chat at a time as TXT, built in the browser), rendered on our server and streamed back without a stored copy.

ChatGPT Extension Safety Checklist

Limitations: What No Extension Review Can Guarantee

• Updates change code silently. Chrome asks again only when an update adds permissions with new warnings. Urban VPN's harvesting arrived in a routine update.
• Badges and reviews lag. Featured listings were active in three incidents, and two remained live after researchers reported them.
• Network checks miss batching. A 30-minute upload, or data hidden inside a legitimate-looking API call, will not stand out.
• Privacy disclosures are self-declared. The listing shows what the developer certified, which is only as reliable as the developer.
• You cannot verify our server from the outside either. Everything we say about AI Toolbox's backend is our statement, backed by our privacy policy, not something you can inspect.

The practical rule: install fewer extensions, prefer publishers you can identify, and remove anything you have not used in a month. For the risks of ChatGPT itself, read is ChatGPT safe; for share links, see how to share a ChatGPT conversation safely.

Frequently Asked Questions

Are Chrome extensions safe?

They can be, but every extension can read and change the pages its permissions cover, and Google's own advice is to approve only extensions you trust. Check the publisher, the permission prompt and the privacy practices before you install, narrow Site access in chrome://extensions afterwards, and remove extensions you no longer use. The same checks apply to browser extensions in Edge, Brave and Opera.

Is it safe to use a ChatGPT Chrome extension?

It can be, if you can verify the publisher and its permissions match its purpose. Any extension with access to chatgpt.com can read your chats, and researchers documented fake ChatGPT extensions stealing session tokens and full conversations in 2025 and 2026.

Is the Featured badge proof that an extension is safe?

No. The badge says an extension follows recommended practices. OX Security, LayerX and Koi Security each found a Featured extension collecting AI chats or ChatGPT session tokens.

Can a Chrome extension read my ChatGPT conversations?

Yes, if it has site access to chatgpt.com or to all websites. It can read the page, and with webRequest it can also see request headers, including the session token.

What should I do if I installed a malicious ChatGPT extension?

Remove it in chrome://extensions, then open ChatGPT Settings, Security, and click Log out all; OpenAI says other sessions can take up to 30 minutes to end. If it could access all sites, change important passwords and clear cookies.

Is OpenAI's own ChatGPT browser extension safe?

It is published by OpenAI and its permissions are documented on ChatGPT Learn. They are broad, including reading data on all websites, and OpenAI says ChatGPT still asks before using each new website or your browser history.

What does "Read and change all your data on all websites" mean?

It means the extension can read and modify every page you open, including ChatGPT, email and banking sites. You can narrow it later in chrome://extensions under Details, Site access.

Can an extension become malicious after I install it?

Yes. Extensions update automatically, and Chrome only asks again when an update adds permissions with new warnings. Urban VPN Proxy started capturing AI chats in version 5.5.0 on July 9, 2025.

Does AI Toolbox read my ChatGPT access token?

Yes. It reads the token from ChatGPT's own requests to load your chat list. Authenticated requests go only to chatgpt.com, chat.openai.com or our API, and our server verifies it once per session and, per our privacy policy, does not store it.

Does AI Toolbox send my conversations to its servers?

Not by default. The searchable copy stays in your browser. Message text leaves it only for a bookmark snippet of up to 300 characters, AI summaries for Context Mentions (3 a day free, unlimited on Premium) and context handoff, and PDF export on Premium or Lifetime.

Sources

• ChatGPT Learn, Browser extension (OpenAI)
• Chrome Web Store Help, Install and manage extensions
• Chrome for Developers, Permissions list
• Chrome for Developers, Discovery on the Chrome Web Store (badges)
• Chrome for Developers, Debug extensions
• Chromium Blog, Transparent privacy practices for Chrome Extensions (November 2020)
• OX Security, Chrome extensions steal ChatGPT and DeepSeek conversations (December 30, 2025)
• LayerX research, How we discovered a campaign of 16 malicious ChatGPT extensions (January 26, 2026)
• Malwarebytes, Malicious Chrome extensions can spy on your ChatGPT chats (January 28, 2026)
• Malwarebytes, Chrome extension slurps up AI chats (December 18, 2025, on Koi Security's research)
• The Hacker News, Fake ChatGPT Chrome extension hijacking Facebook accounts (March 13, 2023, on Guardio Labs' research)
• OpenAI Help Center, How do I log out of all of my devices?
• AI Toolbox privacy policy

Last updated: October 28, 2026