# Browser AI Security — Control Extensions and What Gets Pasted | Cyflow > Authorize which AI extensions may run in Chrome and Edge, give employees a Request Approval path for the rest, and block sensitive paste and upload to AI assistants and personal accounts. Canonical URL: https://cyflow.ai/browser-ai-security/ Last updated: 2026-07-30T00:00:00.000Z --- ![](/background-theme.webp) Browser AI Security # The browser is where AI gets the data Most AI at work never reaches a consent screen. It is an extension somebody installed, or a tab somebody pasted a contract into. The Cyflow extension for Chrome and Edge governs both: which AI extensions may run, and what is allowed to leave in a paste or an upload. [Schedule a Demo](/schedule-demo/)[AI Readiness Assessment](/ai-readiness/) Browser — Paste & Upload ![Cyflow Browser module showing paste and upload events with destination, channel, user and sensitivity](/screenshots/home/channel-browser.webp) The gap ## Nothing in the tenant sees this Tenant-side controls govern grants, sharing and configuration. None of them see a paste. The OAuth side of shadow AI is covered on [shadow AI](/shadow-ai/); these three belong to the browser. ### Extensions read the page An AI assistant extension asks for permission to read and change data on the sites you visit, then keeps it. Whatever is on screen — a customer record, a salary table — sits inside its reach for as long as it stays installed. ### A paste leaves no trace Text lifted out of a document and dropped into a chat window is a copy outside the tenant, made without touching a share, a link or an attachment. No audit log records it. ### Work data, personal destinations A file dropped into a personal Gmail account or a WhatsApp Web tab leaves the tenant through the same browser channel as a paste into ChatGPT — the same blind spot, governed by the same control. The controls ## See it, authorize it, or stop it The extension is the one client-side component Cyflow ships. There is no endpoint agent behind it, and it covers the browser channel only. 01 ### Inventory what is installed Every extension across Chrome and Edge in the tenant, with the permissions it holds and whether it is an AI assistant. ChatGPT, Claude and Perplexity extensions surface with their AI exposure rating rather than as generic browser add-ons. 02 ### Authorize, or make them ask Soft-disable the extensions you have decided against, and give the employee a Request Approval path instead of a dead end — the same pattern as privileged access management. The request arrives with who asked, for which extension, and why. 03 ### Block the sensitive paste, teach in the moment Paste and upload to AI assistants such as ChatGPT and Claude, and to private destinations such as WhatsApp Web and personal Gmail, are recorded with destination, channel, user and sensitivity — and stopped before they land when the content is sensitive. With education turned on, the person is told in the moment why it was stopped and how to handle it, instead of waiting for the next training cycle. Keep reading ## Around the browser - [Shadow AIThe OAuth side: AI apps and agents holding delegated access to the tenant itself.Read more](/shadow-ai/) - [Autonomous remediationWhere a browser finding goes next — the approval queue and the record behind the decision.Read more](/autonomous-remediation/) - [The Cyflow platformEvery channel AI arrives through, in one console, with the screens behind each claim.Read more](/platform/) How the extension behaves ## What it covers, and what it leaves alone. Is there an endpoint agent? No. The Chrome and Edge extension is the only client-side component Cyflow ships, and it covers the browser channel. Everything else in the platform runs against Microsoft 365 and Google Workspace APIs. What happens when somebody tries to use a blocked extension? It is soft-disabled rather than quietly removed, and the person is offered a Request Approval path. The request reaches an approver with the extension, the person and the reason attached, so the answer is a decision rather than a help-desk ticket. Does blocking a paste mean reading everything people type? The control evaluates the content being pasted or uploaded against the destination it is heading for, so a paste into an approved internal tool is not treated like a paste into a consumer AI assistant. What is kept on the event is the destination, the channel, the user and the sensitivity — the basis for the decision, not a transcript. Can the same rules cover WhatsApp Web and personal Gmail? Yes. Private destinations run through the same paste and upload controls as AI assistants. The destination changes; the mechanism does not. Which browsers are supported? Chrome and Edge. Browsers without the extension are outside this control — the tenant-side channels still apply to them, but paste and upload do not. Close the browser gap ## The channel with no audit trail Book a demo and we will walk the extension inventory, the approval request path, and a blocked paste. [Schedule a Demo](/schedule-demo/)[AI Readiness Assessment](/ai-readiness/)