What changed
OpenAI added Chrome extension support to the browser built into the ChatGPT desktop app on Thursday, letting users install and pin extensions without moving their work into a separate browser window, Runtime Wire reported. Support for the Chrome DevTools Protocol came with it.
The built-in browser already handled logins, tabs, downloads, saved passwords and persistent cookies inside its own isolated environment, as OpenAI’s help documentation describes. Extensions are the piece that was missing for the browser to be usable as someone’s main one.
The boundary
The interesting part is not the feature but the fence around it. OpenAI says the agent “cannot interact with any shadow dom or extensions”, meaning a user can open their password manager manually while the agent stays unable to read it or act through it.
That is the correct shape of answer to the obvious risk. An agent that can drive a browser and also reach a password manager running inside that browser is an agent that can authenticate as the user anywhere. Separating the two is what makes installing 1Password next to an autonomous agent a defensible thing to do.
It is, for now, a product description rather than an independently verified security property. Runtime Wire attributes the boundary to OpenAI’s James Sun and notes that no outside assessment accompanies it.
What administrators get
Enterprise administrators can switch the in-app browser off entirely, restrict which websites it reaches, block cookie and password imports, set site-level access rules, and prevent users from overriding any of it.
That list reads like a response to the objection an IT department would raise first, which is that a second browser inside a chat app is a second unmanaged browser. The controls exist; whether they are enabled by default in a given tenant is a separate question.
The context
This lands in a month when agentic coding and browsing tools have been the subject of a string of security findings — a zero-click plugin vulnerability affecting four major coding agents, and separate disclosures about models reaching systems they were not meant to reach. An extension boundary announced in that climate will be tested by researchers quickly.
What to watch
The claim to verify is the shadow DOM one. If the agent genuinely cannot see shadow-root content, a range of injection attacks through extension UI are closed off; if the boundary leaks, the same feature that makes the browser usable becomes the path in. Watch for the first published attempt to cross it.
