ChatGPT now drives your Chrome tabs: what it means for you

On October 15, 2026, OpenAI updated its ChatGPT browser extension. In Chat mode, it looks across all your open tabs to answer you. In Work mode, it acts inside them: sending messages, filling out forms, downloading files. And it does so on sites where your session is already open.

In short: OpenAI summed the update up in one line on X, reported by PPC Land: « We’re bringing the power of computer use to anyone who uses Chrome ». The extension shows 7,000,000 users on the Chrome Web Store, according to Unite.AI. OpenAI’s own documentation rates two settings as elevated risk: the « Allow for all sites » permission, and access to your browsing history. The known weak point of these tools has a name, prompt injection: a web page can carry hidden instructions that the agent then carries out. Anthropic has published figures for its own browser agent; for this update, OpenAI has published none.

What OpenAI announced on October 15, 2026

The announcement came from the ChatGPT account on X on October 15, 2026. OpenAI’s wording, quoted by PPC Land, draws a clear line between two uses: « If you’re in Chat, it can look across your open tabs and gather info. If you’re in Work, ChatGPT can control your Chrome tabs to get things, like sending messages, filling out forms, or downloading files. »

The example given for Chat mode is a comparison: three sofas open in three tabs, to be ranked by dimensions, material, delivery time and return policy. Work mode goes further: it fills in the form sitting in front of you, and can also tidy the pile of tabs you have been dragging around for three days.

Two other changes matter. You can call the feature from the ChatGPT app with an « @Chrome » mention. And a side chat opens your full ChatGPT history next to the page you are reading. According to OpenAI’s documentation, the extension works on Chrome, Edge, Brave, Opera and Vivaldi; the side chat is missing on Opera.

One point stays unclear, and PPC Land flags it. OpenAI says the feature is available « for all ChatGPT plans », but browser control runs through Work mode, which launched in July for Pro, Enterprise, Edu, Plus and Business. Génération-NT wrote on October 19 that the free tier is included. OpenAI does not settle it: check inside your own account.

The four permissions, and why « Allow for all sites » is rated elevated risk

By default, ChatGPT asks for permission before acting on each new site. The documentation lists four possible answers: « Allow once », « Allow for this site », « Allow for all sites » and « Decline ».

Two of those choices are marked Elevated Risk by OpenAI: « Allow for all sites », and access to browsing history. The reason is spelled out: history « can include sensitive telemetry, internal URLs, search terms ». For history there is no always-allow option at all: access is scoped to the current request, and ChatGPT asks again every time.

At install time, it is Chrome that shows you the list of technical permissions. XenoSpectrum breaks it down: read and change your data on all websites, access to the page debugger, history, bookmarks, downloads, tab groups. These are the normal permissions of an extension that drives a browser. They are also, exactly, the permissions of a malicious one.

The real pressure point: an agent working in tabs where you are already logged in

OpenAI’s documentation describes the feature plainly: it lets ChatGPT « read or act on sites where you’re already signed in, such as LinkedIn, Salesforce, Gmail, or internal tools ».

Translate that into student life. The agent has no account of its own: it uses yours, with your session open — university portal, student email, Moodle, assignment submission, internship application site. Anything you can do in one click from those tabs, it can do too.

And nothing guarantees it stops before pressing the button. XenoSpectrum is explicit: « there is no guarantee that every action, such as submitting a form on an approved site, will prompt for reconfirmation ». You can ask it to show you the form before sending, but an instruction you give is not a product safeguard.

Prompt injection: what a web page can tell your agent without you seeing it

Prompt injection is the structural flaw of every agent that reads the web. The model does not really distinguish between what you ask it and what it reads on a page. A piece of text placed in the right spot — white on white, in an invisible form field, in a comment, in a tab title — can therefore give it an order.

OpenAI says so in its own documentation: « Treat page content as untrusted context, and review the website before allowing ChatGPT to continue », and misleading content « can increase the risk that ChatGPT copies this data somewhere unintended ». XenoSpectrum boils the rule down: « Even on a legitimate site you chose, text on the page is not necessarily an appropriate instruction. »

The scenario that concerns you is nothing exotic: a model answer found on a study forum, a lecture PDF uploaded by a stranger, an internship ad on a dubious site. One sentence addressed to the agent is enough for it to try to execute it, while you are looking elsewhere.

23.6% then 11.2% at Anthropic, no public figure at OpenAI

There is one measured point of comparison, and it comes from the competitor. In Piloting Claude in Chrome, published on August 25, 2025, Anthropic describes adversarial testing on its own browser agent: 123 test cases, 29 attack scenarios. Without safeguards, the agent carried out the malicious action in 23.6% of cases; with the added mitigations, 11.2%. On a set of browser-specific attacks — hidden fields in the DOM, text slipped into a URL or a tab title, invisible to a human — the new mitigations take the success rate from 35.7% to 0%.

Two readings. The good one: the risk can be cut sharply. The less good one: 11.2% is not zero, and Anthropic recommended avoiding the agent « for sites that involve financial, legal, medical, or other types of sensitive information ».

OpenAI knows the problem and has written about it. In its post Continuously hardening ChatGPT Atlas against prompt injection, published on December 22, 2025, the company compares prompt injection to scams and social engineering on the web, which have never been « fully “solved” » either, The Decoder reports. OpenAI says it stays « optimistic » that « a proactive cycle of attack detection and rapid countermeasures can significantly reduce real-world risk over time ». That is honest. But for the October 15 update, PPC Land notes that no resistance figure was published.

What ends up in the conversation, and what OpenAI is not saying yet

On retention, OpenAI’s documentation comes down to two sentences. On one side: « OpenAI doesn’t store a separate complete record of your browser actions ». On the other: « OpenAI stores browser activity only when it becomes part of the ChatGPT context ».

The second is the important one. The moment the agent reads a page or takes a screenshot to find its way around, that content enters the conversation — and from then on follows ChatGPT’s retention rules, as XenoSpectrum points out. A tab open on your transcript becomes, at that precise moment, text in a chat history.

Three things are still missing, according to PPC Land: the list of countries covered, a retention policy specific to tab content, and any quantified security measure. Set that against the backstory: according to Unite.AI, OpenAI dropped its Atlas browser, shut down on August 9, 2026, and points its users to this extension instead.

A practical guide for study: three reasonable uses, three hard noes

Three uses where the risk-benefit balance works, because they stay read-only and on sites you chose:

• Comparing open sources side by side. Four articles on the same topic, and a question like « where do these texts contradict each other? ». The agent reads, you decide.
• Collecting bibliography metadata. Titles, authors, dates, publishers pulled from your tabs. The exact formatting in APA 7, ISO 690 or Vancouver is then done with the bibliographie-normes skill, which never invents a missing field.
• Tidying your tabs. The most modest use, and the only entirely risk-free one.

Three hard noes, no exceptions:

• Never « Allow for all sites ». Authorise site by site: two extra clicks, and the only barrier genuinely in your hands.
• Never your student email, your university portal, or an assignment submission. A message sent in your name to your thesis supervisor cannot be taken back, and neither can a botched upload at 11:58 pm.
• Never a form that commits you. Financial aid, enrolment, job applications, payments: you fill it in, you reread it, you submit. You.

And the usual reflex: check your institution’s own AI usage rules. An agent acting in your place inside a learning platform is not treated everywhere as a simple reading assistant.

What this changes for you

The question is no longer « is the AI right? » but « what is it allowed to do? ». The risk with a chatbot was being handed a wrong fact. The risk with a browser agent is an irreversible action taken with your identity. These are not the same skill: the first calls for critical thinking, the second for discipline about permissions.

A web page is not a source of instructions. The rule holds for every agent, not just this one. Before letting a tool act in a tab, ask the simple question: if this page contained a hidden order, what could it make the agent do with my own access rights?

Our take

The most interesting part of this announcement is not the feature, it is the vocabulary. OpenAI rates two of its own settings as Elevated Risk, writes in plain terms that page content must be treated as untrusted, and had already conceded in December 2025 that prompt injection would probably never be solved. A vendor that documents the limits of its own tool this clearly is doing its job.

The imbalance lies elsewhere. Anthropic published measured attack rates, before and after mitigations. For a feature shipped to an extension with 7 million users, OpenAI publishes serious security documentation but no numbers. As long as vendors do not publicly measure the same thing, comparing two browser agents is a matter of intuition. In the meantime, the one variable you genuinely control is the list of sites you authorise.

FAQ

Is the extension available on a free ChatGPT account?

That is the unclear part. OpenAI announces the feature « for all ChatGPT plans », but tab control runs through Work mode, launched in July for Pro, Enterprise, Edu, Plus and Business. Génération-NT writes that the free tier is included. Check what your account actually offers.

What is the difference between Chat mode and Work mode?

In Chat, ChatGPT reads your tabs and answers. In Work, it acts inside them: messages, forms, downloads, tab grouping. The first is reading, the second is action taken with your identity.

Does OpenAI keep my tabs?

The documentation says OpenAI does not keep a separate complete log of your browser actions, but that activity is stored once it enters the conversation context. The text read on pages and the screenshots are part of that context.

Which browsers does it work on?

Chrome, Edge, Brave, Opera and Vivaldi, according to OpenAI’s documentation. The side chat is not available on Opera.

Further reading

• /en/blog/chatgpt-ados-outils-scolaires-securite
• /en/blog/character-ai-faillite-donnees
• /en/blog/dots-openai-agents-permanents-europe
• /en/skills/bibliographie-normes