AI browser extensions are a business risk because they sit inside the browser session where your staff do their work, so they can read what is on screen, and your network security tools usually cannot see what they send out. The most useful first step is to find out which extensions and AI accounts your team actually uses, then decide which ones are approved. Guessing, or issuing a policy nobody checks, leaves the gap open.
This guide is for owners, managers and IT leads at Australian small and medium businesses. It covers what extensions can reach, how personal and free accounts add to the problem, what Australian guidance says, and a control plan you can start this month.
CalibreforumSee How Your Team Uses AICalibre Forum’s AI readiness assessment gathers employee insights and produces a scored report with a 90-day action plan.VisitTL;DR
- AI extensions with broad permissions can read page content, form fields, cookies and chat text, including client data in your CRM, email and documents.
- Staff rarely act maliciously. A free-tier login or a page-summarising extension installed in 30 seconds is the usual route for data to leave.
- Free and personal-tier AI accounts run on consumer terms. Business tiers add contractual data protections and admin controls.
- The Australian Cyber Security Centre (ACSC) and the OAIC both advise against putting sensitive or personal information into public AI tools.
- You cannot control what you cannot see: start with an anonymous, organisation-wide picture of tool use, then set the rules.
Table of Contents
- What an AI extension can actually reach
- When the extension itself is the problem
- Personal accounts and free tiers: the quieter leak
- Free versus paid AI tools: what changes for your data
- What Australian guidance says
- A control plan for extensions and AI accounts
- Warning signs your team may already be exposed
- Promo: see your own picture before you set the rules
- Our perspective
- FAQ
- Sources
What an AI extension can actually reach
A browser extension is a small program added to Chrome, Edge or another browser. Each one asks for permissions when installed. An AI extension that summarises pages, drafts replies or rewrites text usually needs to read the page you are on, which is the whole point of it. That same permission is what creates the risk.
The Cloud Security Alliance explains that extensions operate inside the encrypted session where work happens. They can access page content, keystrokes, form fields, cookies and network requests, which network-layer tools cannot observe without breaking encryption. Put plainly, your firewall sees an encrypted connection to a website. The extension sees the customer record on the screen.
In practice, an extension with broad “read all data” access can scrape source code from private repositories, capture customer details from a CRM dashboard or intercept sign-in tokens. Extensions that talk to each other can also create data flows that standard data loss prevention (DLP) tools do not detect.
The scale matters. A research note citing LayerX’s 2025 report found that 53% of enterprise-installed extensions carry high or critical permission scopes, enough to reach cookies, passwords and full page contents.
What this looks like in a normal week
Picture a bookkeeper at a 25-person accounting practice who installs a free extension to summarise long web pages. She then opens a client’s accounting portal. The extension can read that page, and its privacy terms are whatever the developer wrote. Nobody in the business reviewed them, and nobody knows the extension exists.
That scenario needs no attacker. It needs one helpful tool and one busy afternoon.
When the extension itself is the problem
Some AI extensions are built to collect data. Microsoft’s security team reported in March 2026 that malicious AI assistant extensions harvested full URLs and AI chat content from platforms such as ChatGPT and DeepSeek. The data was stored locally, then uploaded to remote servers on a schedule. Telemetry was switched back on after updates even where a user had declined it.
Two lessons follow for a business:
- A tool that looks like a helper can quietly collect chat histories. Those chats often contain client names, pricing, draft contracts and internal discussion.
- Updates change behaviour. An extension you checked once can behave differently after the next release, so a one-off approval is not enough.
A second class of risk is manipulation rather than theft. A web page can contain hidden instructions that influence an extension’s AI component, so it takes actions the user did not intend. This is called prompt injection. It matters most for extensions that can act on your behalf, such as sending messages or filling forms, because they act with your logged-in permissions.
Personal accounts and free tiers: the quieter leak
Extensions are one route. The other is staff using a personal AI login for client work. The Australian securitypolicy.com.au guide notes that most unsanctioned AI use is not malicious: it is a personal ChatGPT login, a free tier or a page-summarising extension. It adds that a written ban without technical controls, approved alternatives and training is unlikely to be enough.
The Cloud Security Alliance note reports LayerX data finding that 40% of files uploaded to AI platforms contained personal or payment-card data. When the account is personal and there is no corporate agreement, the business has no contractual right to ask for deletion and no visibility of what was shared.
Three consequences are worth naming for a manager:
- The history belongs to the person. Client details sit in an account the employee owns, and it leaves with them.
- There is no record. If a client asks how their data was handled, you cannot answer.
- Outputs go unchecked. Nobody reviews AI-drafted advice that can read as confident and still be wrong.
Free versus paid AI tools: what changes for your data
Paying does not automatically mean private. Nexia Australia describes three tiers. A free public tier offers minimal control, and prompts may be retained, reviewed or used to improve models. A paid consumer tier requires sign-in, but “private” does not necessarily mean your inputs are excluded from training. An enterprise tier runs under a business agreement where inputs and outputs are not used to train the provider’s general models, with identity controls, audit capability and retention settings.
The same article cautions that even enterprise AI depends on correct licensing, configuration, permissions and user behaviour. Buying the right tier is the start of the job, not the end.
| Free tier | Paid personal tier | Business or enterprise tier | |
|---|---|---|---|
| Terms | Consumer | Consumer | Business agreement |
| Training on your inputs | May be used | May still apply | Not used under business terms |
| Admin controls | None | None | Central admin, sign-in controls |
| Visibility for your business | None | None | Audit and retention settings |
| Suitable for client data | No | No | Yes, once configured |
This summary follows the three-tier description above. Always read the provider’s own current terms, because plans and defaults change.
For most small businesses the practical answer is a single approved business-tier tool with managed logins. Staff then have a sanctioned way to get the benefit, and the reason to reach for a personal account disappears.
What Australian guidance says
You do not need to be a lawyer to act on the official advice, which is consistent across the main bodies.
The ACSC published Using AI securely in your business in October 2026. It advises against sharing sensitive business or customer information, such as passwords, financial details or confidential data, with AI tools. It also asks you to consider the provider’s reputation, where data is stored, its privacy policy and how reliable its outputs are. Its framing is useful: treat AI like any other online service, helpful but not always private or secure.
The OAIC, the privacy regulator, recommends not entering personal information, particularly sensitive information, into publicly available generative AI tools. The Privacy Act and the Australian Privacy Principles apply to AI use involving personal information. Under APP 6, use or disclosure is generally limited to the purpose the information was collected for, unless consent or another qualifying basis applies.
In a December 2025 blog the OAIC also warned that once personal information is entered into a generative AI system, it can be very difficult to track or control and potentially impossible to remove. It suggests a Privacy Impact Assessment, prohibiting personal information uploads where risks are too high, and actively managing privacy settings on enterprise licences.
If your business holds customer or attendee data, settle who controls it before any tool touches it. A piece on data ownership in Australia shows how quickly that question arises once customer data moves between platforms.
For how this plays out day to day, our guide to what staff can paste into AI tools under the Privacy Act goes through the common cases.
A control plan for extensions and AI accounts
The ACSC’s guidance on protecting AI services lists the building blocks: an inventory of AI accounts and credentials, least privilege, phishing-resistant multi-factor authentication, secured API keys and monitoring of usage and unusual activity. Here is how a small business can turn that into steps.
1. Find out what is in use
List every AI tool and extension staff use, including free ones and personal logins. The difficulty is that people hide nothing deliberately; they simply do not think of a browser add-on as “software”. Ask the right questions, and ask them anonymously, or you will hear only the answers people think you want.
This is where our assessment starts. Calibre Forum runs a structured, anonymous survey across your staff, so people can say honestly which tools they use and for which tasks. Nothing is installed on devices and no individual data is collected. The result is an organisation-wide map you can act on.
2. Decide what is approved
Sort what you find into three groups: approved for client data, approved for public information only, and not permitted. Keep the list short. An approved business-tier tool with managed logins should cover the main jobs staff were using free tools for. Our guide to AI access control covers who should get which tool and with what permissions.
3. Manage extensions centrally
Your browser’s enterprise management settings (Chrome and Edge both have them) let an administrator allow-list extensions and block the rest. Review permissions before approving: an extension that needs to “read and change all your data on all websites” needs a real business reason. Recheck after major updates, since behaviour can change between versions.
4. Require work accounts and strong sign-in
Forbid personal and free-tier accounts for work, and require organisation-managed logins with multi-factor authentication. Keep client data out of anything that cannot be tied to a business agreement.
5. Write the policy and back it with training
A short rule set people can remember works better than a long document. Cover what can and cannot be pasted in, which tools are approved and who to ask. See our guides on generative AI policy and AI policy in Australia for what to include and how to roll it out.
6. Prioritise, then repeat
You will not fix everything at once. The National AI Centre suggests scoring each issue on factors such as volume, repetitiveness, data availability, error tolerance and cost, then starting with simpler options where they deliver most of the benefit. Apply the same thinking to risks: fix the high-exposure, low-effort items first, and review on a regular cycle because staff and tools change.
Warning signs your team may already be exposed
Several patterns suggest unmanaged AI use is already happening:
- Staff mention AI-written drafts but no one can say which tool produced them.
- Browser profiles are signed into personal Google or Microsoft accounts on work machines.
- Client names or numbers appear in documents that were clearly polished by an AI tool.
- No one owns the question “which AI tools do we allow?”
- Departing staff take their own AI accounts, and the chat histories in them, with them.
For a deeper look at the account, extension and recorder side of this, read our overview of shadow AI workplace risks, and see how AI data leakage happens for the mechanics.
Promo: see your own picture before you set the rules
If you want the facts about your own business rather than industry averages, the Calibre Forum report gives you them. Your staff complete the anonymous survey, and we combine the responses into a scored report that maps current capabilities, flags risks and sets out a tailored 90-day action plan.
The report is A$1,990 as a one-off. The membership is A$2,388 per year and covers recurring assessments and reports, which suits teams that want to track progress quarter by quarter. Start from the pricing page, or see what is in the report first.
Our perspective
Every business we talk to about AI risk asks about tools first: which extension, which chatbot, which plan. The better question is who is using what, for which task, and why.
Blocking one extension solves one problem for one week. People use AI because it saves them time, and they will find another route if you offer no sanctioned one. Real control starts with honest answers, and honest answers come when staff know the survey is anonymous and nobody is being singled out.
That is why we survey every staff member rather than install monitoring software. You get a map of tool use and workflows across the whole organisation, a scored view of where you are strong and where you are exposed, and a 90-day plan with concrete steps. Owners get visibility, IT gets priorities and staff keep their trust in the process.
Anthony
FAQ
Are AI browser extensions safe for business use?
Some are, but each needs a review of its permissions, its developer and its data handling before staff use it with client information. Extensions that read all page content can reach anything on screen. Approve a short list centrally rather than letting staff choose individually.
Is it a problem if staff use personal AI accounts for client work?
Yes. Personal accounts run on consumer terms, the business has no agreement covering the data, and the chat history belongs to the individual. The OAIC advises against entering personal information into publicly available generative AI tools, so provide an approved business-tier tool with managed logins instead.
What is the difference between free and paid AI tools for business data?
Free and personal paid tiers generally run on consumer terms, and inputs may be retained or used to improve models depending on settings. Business and enterprise tiers operate under a business agreement with stronger data protections and admin controls. Check the provider’s current terms, because defaults change.
How do I find out which AI tools my staff already use?
Ask them, anonymously and across the whole team, and cover browser extensions and personal accounts explicitly. Our assessment does this through a structured staff survey and turns the answers into a scored report with a 90-day plan.
Sources
- Insecure GenAI Plugins (Akamai)
- AI Browser Extensions: Shadow AI’s Hidden Attack Surface (Cloud Security Alliance)
- AI Browser Extensions: The DLP-Invisible Enterprise Attack Surface (Cloud Security Alliance)
- Malicious AI Assistant Extensions Harvest LLM Chat Histories (Microsoft Security Blog)
- Responsible AI Use Policy Guide for Australian Business
- Free, paid or enterprise: Choosing AI with confidence (Nexia Australia)
- Using AI securely in your business (ACSC)
- Protect your organisation’s AI services (ACSC)
- Guidance on privacy and the use of commercially available AI products (OAIC)
- GenAI tools in the workplace (OAIC)
- Identify opportunities (National AI Centre)
- Event Data Ownership: Who Controls Attendee Data in Australia
Recommended
- Shadow AI Workplace Risks: Accounts, Extensions, Recorders
- AI Vendor Risk: A One Page Checklist for Business Teams
- AI Risk Mitigation: A Practical Guide for Australian Businesses
- AI Risk Register: What to Include and How to Build One
General information only. Articles on this blog are written with the help of AI writing tools and published by Calibre Forum. They are not legal, insurance, tax or financial advice, so check anything important with a qualified adviser.