ChatGPT in Chrome: The Agent Now Works Inside Your Signed-In Tabs

OpenAI’s updated ChatGPT Chrome extension can now send messages, fill out forms and download files inside the tabs you already have open, including the ones where you’re signed in to Gmail, Salesforce or internal tools. For anyone who lives in a browser at work, that turns an assistant that summarizes pages into an agent that acts with your credentials, and the most important setting is no longer the model but the per-site permission prompt.

What Happened

The Decoder reports that ChatGPT can now access open Chrome tabs and take actions on them. Users target open tabs with @chrome. Chat mode pulls data from several tabs at once, and Work mode lets ChatGPT control tabs through Computer Use to send messages, fill out forms, download files or group tabs. The full chat history now sits in a sidebar next to the page being viewed. In OpenAI’s examples, the extension compares products across open tabs by size, material, shipping time and return rules, summarizes articles in plain language, and matches price pages from different sellers. The updated Chrome extension works with all ChatGPT plans.

OpenAI’s browser extension documentation shows the reach is wider than Chrome. Tab mentions and browser control work from the ChatGPT desktop app in Chrome, Edge, Brave, Opera and Vivaldi; side chat works in all of them except Opera. The documentation states plainly that ChatGPT “can read or act on sites where you’re already signed in, such as LinkedIn, Salesforce, Gmail, or internal tools.”

Why It Matters

OpenAI also offers a built-in browser, invoked with @Browser, that keeps browsing inside ChatGPT without using your regular browser profile. The extension is the opposite choice: it works in your real profile, alongside the sites you’re already signed in to. OpenAI’s documentation is candid about what that requires: Chrome’s install prompt may ask for permission to access the page debugger, read and change all your data on all websites, read and change browsing history on all signed-in devices, manage downloads and manage tab groups.

OpenAI layers its own controls on top. By default ChatGPT asks before interacting with each new website, keyed to the host name, with four choices: allow once, allow for this site, allow for all sites, or decline. Users can keep an allowlist and a blocklist under Settings > Computer Use. Browser history access is requested per task and has no always-allow option, because, as the documentation warns, history can include internal URLs and search terms, and “malicious or misleading page content can increase the risk that ChatGPT copies this data somewhere unintended.” That is a prompt-injection warning in plain language: a page the agent reads can try to steer what it does in another tab.

What This Means for Builders

OpenAI says it doesn’t store a separate complete record of browser actions; it stores browser activity only when it enters the chat context, such as page text, screenshots, tool calls and summaries. Teams evaluating this for internal tools should note the documentation’s own advice to avoid sending secrets or highly sensitive data through browser tasks unless the user is present to review each prompt. Stack Archive’s look at Claude Code’s browser automation covers the same tradeoff from the developer side: the more of your logged-in web an agent can touch, the more the guardrails matter.

Source: The Decoder

Content created with AI assistance and reviewed for accuracy.