OpenAI Lets ChatGPT Drive Your Chrome Tabs as a Full Browser Agent

OpenAI has quietly turned its ChatGPT extension for Chrome into something much closer to an autonomous assistant. In an update announced on October 15, 2026, the add-on gained the ability to read every tab a user has open and to act inside those pages — filling out forms, sending messages, downloading files and grouping a sprawling pile of tabs into something manageable.

OpenAI described the release, published from its official ChatGPT account on X, as bringing “the power of computer use to anyone who uses Chrome.” The extension, which the Chrome Web Store lists at 7 million users, now spreads its new capabilities across the two modes the assistant already offers.

• Reading versus acting: Chat mode pulls context out of open tabs to sharpen an answer; Work mode, OpenAI’s agent for longer multi-step jobs, takes direct control of those tabs.
• Plan coverage: The extension is available across all ChatGPT tiers, though Work remains “limited” on Free and Go compared with Plus and Pro.
• Broad permissions: Installation requests the right to read and change data on all websites, with signed-in sessions such as Gmail or Salesforce explicitly in scope.
• Unresolved risk: OpenAI has warned that prompt injection — hidden instructions embedded in a web page — may have no definitive cure in browser agents.

Two modes, one clear dividing line

OpenAI’s announcement draws a firm line between retrieval and action. “If you’re in Chat, it can look across your open tabs and gather info,” the company wrote. The more consequential half sits in Work: “If you’re in Work, ChatGPT can control your Chrome tabs to get things, like sending messages, filling out forms, or downloading files.”

Published sample prompts hint at the ambition: comparing three couches open in separate tabs by dimensions, material, delivery time and return policy; weighing several contractors’ quotes before drafting an email to the winner; filling a registration form from an event brief and stopping before submission; or completing a new-dentist form while adding the appointment to work and personal calendars.

The browser interface received a matching upgrade. A sidebar now carries a user’s entire ChatGPT history, letting questions and tasks run alongside the page being viewed. The store listing, showing version 1.26.1005.11759, notes the extension works in the background rather than seizing the active session.

Permissions, privacy and the injection problem

None of this comes free. Installation triggers a permission prompt covering the ability to read and modify data on all websites, and OpenAI’s documentation states that ChatGPT can read or act on sites where a user is already signed in, citing LinkedIn, Salesforce and Gmail. For each new host, users choose between allowing once, allowing for that site, or allowing for every site — the last flagged as elevated risk. Browser history is stricter still: access is requested per request, with no always-allow option.

On data handling, OpenAI says it does not keep a separate full log of browser actions, though anything entering the chat — text, screenshots, summaries — is retained. Memory, where enabled, applies to these tasks, and the official guidance is blunt: do not send secrets or highly sensitive material through browser automation.

The deeper vulnerability is instruction injection, where hidden text on a page tries to hijack the agent. OpenAI has already cautioned that the flaw may have no definitive fix for browser agents, which makes per-site authorization the only defensible default.

Availability and the browser battle behind it

Beyond Chrome, the extension runs on Chromium-based rivals including Microsoft Edge, Brave, Opera and Vivaldi, a capability dating to August; side chat works everywhere except Opera. Setup runs through the Computer Use section of the desktop app, referencing a browser with an @-mention inside a Work or Codex chat.

The update also closes a strategic circle. OpenAI retired its standalone ChatGPT Atlas browser in August and has been folding those capabilities into the extension rather than asking people to switch browsers — a far cheaper route into Chrome’s installed base. Google is pushing the other way, embedding Gemini and its Auto Browse agent directly into Chrome.

For users, the calculus is straightforward but uncomfortable. Installing an extension is a smaller ask than abandoning a browser, yet what it grants is enormous: an agent that can click and type anywhere a session is already authenticated. Until instruction injection is solved, site-by-site consent is not a nuisance setting — it is the safety mechanism.