playbook
Password managers and AI browser extensions
A practical small-team playbook for deciding when AI browser extensions can run near password managers, autofill forms, admin pages, and credential workflows.
Bottom line
Do not let an AI browser extension run on password manager pages, identity provider pages, admin consoles, payment systems, or credential reset flows unless you have a specific approved reason. A password manager is still the right place to store credentials, but an over-permissioned browser extension can see pages, inject scripts, read tab metadata, or operate near autofill workflows depending on its permissions and host access.
The practical rule is simple: approve the password manager, restrict AI extensions around credential workflows, and record exceptions in your Browser Extension Allowlist template.
Password manager risk matrix
| Scenario | Risk | Default decision |
|---|---|---|
| AI extension runs on normal research pages while password manager is installed | Low to medium | Allow only if permissions and vendor are reviewed. |
| AI extension has access to every website | High | Reject or restrict with runtime blocked hosts. |
| AI extension runs on login pages where autofill appears | High | Block unless there is a documented business need. |
| AI extension runs on password manager web vault pages | High | Block. |
| AI extension runs on identity provider, SSO, MFA, or admin console pages | High | Block. |
| AI extension can read clipboard content | High | Restrict and warn employees not to copy passwords, recovery codes, or API keys into prompts. |
| AI extension can read Gmail, Docs, CRM, helpdesk, or support inbox pages | High | Review with the AI Tool Risk Checker before approval. |
| Browser agent or AI assistant signs in to sites for the user | High | Require explicit human approval, password manager review, and a site-by-site allowlist. |
If a tool needs broad browser access and also runs near passwords, treat it as a privileged workflow, not a convenience extension.
Autofill boundary rules
Use these rules before approving any AI browser extension:
| Boundary | Rule |
|---|---|
| Password manager vault | AI extensions must not run on web vault pages or password manager admin pages. |
| Login forms | AI extensions should not observe, summarize, rewrite, or interact with login forms unless approved for a narrow site. |
| Autofill prompts | Employees should not ask an AI extension to fill, copy, reveal, or explain credentials. |
| Password reveal actions | Require device authentication or user confirmation where the password manager supports it. |
| Password exports | Block AI extensions from password export, import, backup, or migration pages. |
| Recovery codes | Treat recovery codes, backup codes, seed phrases, and TOTP seeds as secrets. |
| Clipboard | Do not copy passwords, passkeys, recovery codes, API keys, or private tokens while an unapproved AI extension can read the page or workflow. |
| Shared computers | Do not approve AI extensions for shared browser profiles that also save credentials. |
The point is not that autofill is unsafe. The point is that autofill, clipboard, and page-reading extensions create a workflow where the wrong extension can observe the wrong moment.
Extension permission review
Review the extension manifest and store listing before approval:
| Permission or pattern | Why it matters | Decision rule |
|---|---|---|
host_permissions | Allows access to matching sites. | Require exact hosts where possible. Avoid broad https://*/*. |
content_scripts.matches | Allows content scripts to inject into matching pages. | Block on credential, admin, finance, HR, and customer-data sites. |
<all_urls> | Covers a broad set of hosts. | Treat as high risk. Require a written exception. |
activeTab | Grants temporary tab access after user action. | Prefer this over persistent all-sites access when functionally sufficient. |
tabs | Can expose tab metadata such as URL and title depending on use. | Check whether sensitive URLs reveal customer or admin context. |
cookies | Can be sensitive around account sessions. | Reject unless there is a strong technical need and admin owner. |
webRequest or traffic-related access | Can observe or modify network behavior depending on API use. | Treat as high risk. |
| Clipboard behavior | May expose secrets copied during work. | Add employee rule and block around credential workflows. |
If the extension cannot work without broad access, decide whether the business value is worth a restricted pilot. Do not approve it silently.
Sensitive site policy
Create a blocked host list for AI extensions. Start with these categories:
| Site category | Examples | Policy |
|---|---|---|
| Password managers | 1Password, Bitwarden, Google Password Manager, LastPass, Keeper, Dashlane web vaults | Block AI extension runtime access. |
| Identity and SSO | Okta, Microsoft Entra, Google Admin, Cloudflare Access, Duo | Block. |
| MFA and recovery | Backup code pages, authenticator enrollment, passkey setup, recovery email flows | Block. |
| Finance and payments | Stripe, banking, payroll, accounting, invoicing | Block. |
| Admin consoles | Cloudflare, Vercel, AWS, Google Admin, GitHub org settings | Block unless a role-specific extension is approved. |
| Source code and production | GitHub, GitLab, CI, logs, incident tools, deployment dashboards | Restrict to engineering-approved tools. |
| Customer data | CRM, helpdesk, support inboxes, user admin panels | Restrict with data owner approval. |
| Docs and email | Gmail, Google Docs, Drive, Microsoft 365 | Restrict to approved workflows. |
For Chrome-managed environments, enforce this with Chrome Enterprise extension policy where available. For unmanaged startups, publish the rule, review installed extensions monthly, and move toward managed browser profiles as soon as the team grows beyond ad hoc trust.
Approval checklist
Use this checklist before letting an AI extension coexist with password manager workflows:
- Identify the extension ID, vendor, owner, and business use case.
- Record requested permissions and host access.
- Check whether it asks for all-sites access, content scripts, cookies, traffic access, or clipboard-related behavior.
- List password manager, identity, admin, finance, source-code, HR, and customer-data sites where the extension must not run.
- Confirm whether the password manager has settings for autofill confirmation, biometric unlock, admin policies, or extension deployment.
- Test the extension in a separate pilot browser profile.
- Confirm it does not run on blocked credential sites.
- Confirm employees know not to paste passwords, recovery codes, seed phrases, or API keys into AI tools.
- Score the extension with the AI Tool Risk Checker.
- Record the decision in the Small Team AI Security Checklist.
No approval should be permanent. Give every AI browser extension a renewal date.
Password manager settings to verify
Do not assume every password manager behaves the same way. Verify these settings in the specific product your team uses:
| Control | Why to check it |
|---|---|
| Browser extension deployment | Confirm whether employees install the official extension or unmanaged lookalikes. |
| Autofill confirmation | Reduce accidental fills into phishing, embedded, or unexpected forms. |
| Device authentication or biometric unlock | Add friction before revealing, copying, editing, or filling sensitive items. |
| Password export controls | Limit who can export vault data. |
| Admin policy controls | Confirm what business-plan settings are actually enforced. |
| Vault sharing rules | Make sure shared credentials are not visible to unnecessary roles. |
| Recovery and emergency access | Review who can recover accounts or access shared vaults. |
| Audit or activity logs | Check whether you can investigate credential reveal, copy, or sharing events. |
| Browser profile separation | Keep company password manager use inside managed work profiles. |
If you cannot enforce these settings yet, compensate with a smaller AI extension allowlist and stricter sensitive-site blocks.
Employee rule
Copy this into your browser extension policy:
Employees may use approved AI browser extensions only in approved work contexts.
Do not use AI browser extensions on password manager pages, login forms, SSO pages, MFA setup, password reset flows, admin consoles, finance systems, source-code repositories, production dashboards, HR systems, or customer-data tools unless the extension has been explicitly approved for that site.
Do not paste passwords, passkeys, recovery codes, seed phrases, API keys, private tokens, customer secrets, or password manager exports into AI tools.
If an extension asks for access to all websites, Gmail, Docs, Drive, CRM, browser history, clipboard, cookies, or network traffic, request approval before installing or using it for company work.This rule is intentionally plain. Employees need a clear boundary, not a taxonomy lecture.
Incident response
If you discover an AI extension ran near credentials:
| Step | Action |
|---|---|
| 1 | Disable or remove the extension from affected browsers. |
| 2 | Capture extension ID, version, permissions, affected users, and affected sites. |
| 3 | Check whether passwords, passkeys, recovery codes, API keys, or admin sessions may have been exposed. |
| 4 | Rotate affected passwords and revoke suspicious sessions or OAuth grants. |
| 5 | Review password manager audit logs if available. |
| 6 | Review browser history, extension install history, and Chrome policy logs if managed. |
| 7 | Move the extension to Blocked or Restricted in the allowlist. |
| 8 | Update the sensitive site policy and employee rule. |
If the extension touched customer systems, source-code systems, payment systems, or identity systems, handle it as a security incident, not a helpdesk cleanup.
Evidence checked
- Chrome Extensions: declare permissions
- Chrome Extensions: activeTab permission
- Chrome Extensions: match patterns
- Chrome Enterprise policy list: ExtensionSettings
- Google Password Manager
- 1Password Support: Save and fill passwords in your browser
- Bitwarden Help: Autofill from browser extensions
- Chrome Enterprise extension policy for startups
- Browser extension allowlist template
FAQ
Should we ban password manager browser extensions?
No. A managed password manager extension is usually better than reused passwords, shared spreadsheets, or copied secrets. The tighter rule is to approve the password manager and restrict unrelated AI extensions around credential workflows.
Is it safe if the AI extension only activates when clicked?
It may be lower risk, especially if it uses a user-gesture model such as activeTab, but you still need to review host access, content scripts, clipboard behavior, and where employees are likely to click it.
Should AI extensions be blocked on login pages?
Yes by default. Login pages, SSO pages, MFA pages, reset flows, and password manager vault pages should be on the blocked host list unless a narrow exception is approved.
What if the extension needs access to Gmail or Docs?
Review it as a separate high-risk workflow. Use the AI extensions that can read Gmail or Google Docs checklist and confirm OAuth scopes as well as browser permissions.
What should we do for unmanaged browsers?
Publish the employee rule, inventory installed extensions, remove obvious risks, and move toward managed work profiles. For the highest-risk roles, start with a manually maintained allowlist before rolling out full Chrome policy.
Recommended next step
Add password manager web vaults, SSO, MFA, admin consoles, payment systems, source-code systems, and customer-data tools to your blocked host list. Then review each AI browser extension through the Browser Extension Allowlist template before it is allowed near credential workflows.