%201.svg)
HIPAA Compliance Checklist for 2025
In March 2025, a security researcher offered fifty dollars for a Chrome extension.
The tool was called Website Blocker. It did what it said, it had cleared Google's review, and it already held two permissions that matter:
- the ability to rewrite network requests
- access to every URL the user visits
The developer, based in India, couldn't find a way to accept an international payment. So he handed the extension over for nothing and asked only to be remembered if he could help again.
Google transferred it in about a week, with everything intact:
- same extension ID
- same code and settings
- still installed and running for every existing user
The researcher, John Tuckner of Secure Annex, then pushed an update. It cleared review in a couple of hours.
He used it to redirect traffic to a Rick Astley video, because the point was the demonstration. The same access could have profiled every page those users visited, or quietly rewritten one bank's login portal.
Nothing here was shadow AI, and nothing here was a breach. A piece of approved software changed hands, and every organisation with it installed carried on treating it as approved.
That is the problem with how most enterprises govern AI right now; the inventory is a list of applications, and the exposure is not in an application.
The Extension Resale Market Nobody Briefed Your Security Team On
Tuckner found that listing on extensionhub.io, a marketplace where developers sell extensions with the user base, reviews and code attached. CyberScoop covered the broader trade shortly after. Prices ran from $50 for an extension with five users to $100,000 for one with 400,000.
That expensive listing was an ad blocker, and it sold. Here is how quickly the new owner moved:
The buyer registered the destination before they finished buying the source.
The 2026 Version Has AI in It
QuickLens was a Google Lens wrapper with screen capture and area selection. It worked well enough that Google gave it a Featured badge, and then, as Secure Annex documented, it was sold.
Why QuickLens Is the Case Worth Remembering
Two details set it apart:
- The extension kept working. Google Lens integration stayed fully intact, so no user had a reason to look twice.
- The malicious code never appeared in the source files. Static analysis showed only a small function that creates image elements; the real payloads arrived from a server at runtime and lived in local storage.
A hundred and thirty-one days from Featured to weaponised, with one permission prompt in between.
This Is Not a Long-Tail Problem
It would be comforting to file all of this under obscure tools nobody in a real company uses. Two recent cases say otherwise:
- OX Security identified two extensions impersonating legitimate AI assistants, with roughly 900,000 users between them, scraping complete conversation histories every thirty minutes. The Cloud Security Alliance found them active across more than 20,000 enterprise tenants.
- In July 2025, a widely installed VPN extension quietly shipped an update that intercepted conversations from eight AI platforms, including ChatGPT, Claude, Gemini and Copilot, across more than eight million installs. It wasn't disclosed until December.
That's five months of silent collection, from a tool most IT teams would have classified as a utility rather than an AI application at all.
Approval Is a Judgement About Software That Refuses to Hold Still
Your AI governance programme almost certainly runs on a binary; sanctioned tools on one side, shadow AI on the other, and a review process that moves things from the second column to the first.
The binary is quietly out of date. LayerX's 2026 extension research found that:
- 99% of enterprise users run at least one extension
- more than a quarter run ten or more
- roughly one in six already runs an AI extension specifically
That is not an emerging category waiting for a review cycle. It is already installed, at a density most CIOs would put at a fraction of the real number.
More to the point, the binary assumes software is a fixed object you inspect once. Browser-resident AI breaks that assumption in three ways.
It Inherits Identity Instead of Requesting It
An extension or in-browser agent doesn't authenticate. It runs inside a session the employee already opened, so to Salesforce, the finance system or the shared drive, it simply is that employee.
That means none of the usual evidence ever gets generated:
- no OAuth grant to review
- no service account to inventory
- no SSO event to correlate
It Changes After You Approve It
Extensions update themselves silently. A user sees a prompt only when new permissions are requested, and that prompt is a single click most people have been trained to accept.
The same LayerX research found AI extensions are six times more likely than other extensions to expand their permissions over time. More than 60% of users run an AI extension whose permissions changed within the year, which is why it pays to know what your AI tools can actually access through the permissions you granted.
It Can Be Sold
Ownership transfer is a form and a five-dollar developer fee. Users are never notified, and unless the new owner asks for new permissions, the transition is invisible from the outside.
The practical effect is a gap in change control that exists nowhere else in the enterprise.
You can name the version of your ERP. Ask your team to name the current version of the AI extension your CFO is running, and who owns it this quarter.
The Browser Is Where Enterprise AI Actually Runs, and Nobody Owns It
Most discovery programmes were built for a world where software announced itself. Four sources usually carry the load, and browser-resident AI slips past all four:
We've covered the five ways shadow AI enters your environment that SSO logs and CASBs won't show, and why DLP, CASB and LLM gateways all miss browser-level prompt activity.
The Scale of What's Being Missed
Netskope's Cloud and Threat Report, published in January 2026, puts numbers on it:
- the average organisation uses eight distinct generative AI applications; the top 1% use eighty-nine
- the tracked universe has grown fivefold, to more than 1,600 apps
- median monthly prompts rose sixfold in a year, from 3,000 to 18,000
- organisations average 223 generative AI data policy violations a month, double the previous year
- only half enforce data protection policies for generative AI at all
MCP Servers Make the Visibility Problem Worse
Many Model Context Protocol servers run as local subprocesses inside a developer's IDE or desktop app. They talk to the agent through a pipe on the same machine, so they never cross a network boundary.
There is nothing for a network-era discovery tool to observe; the traffic does not exist. It's the reason MCP servers are becoming your next ungoverned access surface.
Simon Willison, who has done more than anyone to document how these systems fail, put the structural version plainly: "I strongly expect that the entire concept of an agentic browser extension is fatally flawed and cannot be built safely."
You don't have to agree with him to accept the operational consequence. If the safest assumption is that this category can't be secured by design, knowing precisely where it runs stops being a nice-to-have.
If you want the practical version of that question, our walkthrough on how to find and govern every AI agent in your stack covers the mechanics.
An Agent Wearing Your CFO's Badge
Every non-human identity framework in circulation assumes machine identities get provisioned. Someone creates the service account, issues the key and, in a well-run environment, records an owner.
A browser agent is a non-human identity that was never provisioned. It has:
- no owner
- no lifecycle
- no entry in any register
- no revocation path other than the human whose session it borrowed
Where the Governance Gap Becomes Measurable
Gravitee's State of AI Agent Security 2026, based on more than 900 respondents, shows how far confidence has drifted from reality:
The agentic browsers themselves aren't closing the distance. LayerX tested five browsers against a hundred live phishing pages; Comet blocked 7% of them, against 47% for Chrome and 54% for Edge.
An agent with a seven-percent phishing block rate, operating with your finance lead's authenticated session, is not a productivity tool with a security caveat. It is an unmanaged identity with delegated authority, and it needs the same identity governance you apply to every other AI agent.
What Changes When the Unit of Governance Stops Being the App
The fix is not another policy document, and it is not a blanket ban that pushes employees onto personal devices. It is a change in what the programme actually counts.
In practice, that shift comes down to six moves.
1. Correlate Discovery Sources Instead of Trusting One
An identity provider alone shows you the federated list. Browser telemetry, finance data and firewall logs together show you what is actually in use, which is a materially different set.
2. Risk-Score What You Find
Treating every unsanctioned tool as an equal fire drill is how discovery programmes die; the list is long and the team is small. Prioritising by permission scope, data access and publisher posture makes the list workable, because AI risk is about blast radius, not the number of tools you have.
3. Treat Ownership and Permission Changes as Security Events
Both are observable, both are early, and neither shows up in an annual review cycle. The QuickLens users had sixteen days between the ownership change and the weaponised update.
4. Extend Access Reviews to the Machines
If a service account, an API key or an in-browser agent can reach production data, it belongs in the same certification cycle as the people who can. Here's how to bring non-human identities into your access reviews.
5. Enforce at the Moment of Use, Not Through a Ban
This is the move most programmes skip, and it decides whether the other four survive contact with employees.
- An outright ban on AI extensions moves the behaviour to a personal laptop or phone, where there is no telemetry at all; the organisation trades a visible risk for an invisible one.
- Intercepting an attempt to reach an unsanctioned AI tool and redirecting the person to an approved equivalent keeps the work inside the perimeter, which a policy document in Confluence has never once managed to do.
That is the core of AI policy enforcement: control at the moment a decision gets made, not in a document nobody rereads.
See What's Running Inside Every Session
6. Close the Offboarding Gap
When someone leaves, their extensions and any tokens tied to them rarely feature in the checklist. The access outlives the employee by default rather than by oversight, the same way offboarding an employee doesn't stop the AI agents they created.
Where CloudEagle.ai Fits
CloudEagle.ai was built for this correlation problem specifically. It maintains a proprietary inventory of AI applications, agents and MCP servers, then correlates browser plugin data, firewall and CASB logs, single sign-on and finance signals against it.
That surfaces the shadow AI a single source would miss, with each discovered tool risk-scored so teams know what to review first. See how EagleIQ correlates seven discovery sources for complete shadow AI visibility.
Non-human identities sit in the same system as human ones, with the same lifecycle controls and the same reviews. That's what makes an inherited-authority agent something you can actually revoke.
Five Questions Worth Asking Before Your Next AI Governance Review
Take these into the meeting. The answers are more diagnostic than any maturity model.
- How many AI browser extensions are installed across the organisation right now, and who reviewed the version that is running today?
- If an approved extension changed owner last month, which system would have told us, and how long would it have taken?
- When an AI agent takes an action inside an employee's authenticated session, whose name appears in the audit log?
- Which of our AI tools did we find through the identity provider, and which would only ever appear in browser telemetry?
- If an auditor asked for evidence of least-privilege access across our AI tools and agents today, how many days would that take to assemble?
If the answer to any of the first four is "we would find out afterwards," the governance programme is measuring approvals rather than exposure. For question five, our guide to AI governance audit readiness covers what evidence auditors now expect.
The Point Is Not That Extensions Are Dangerous
Plenty of them are useful, and a policy that treats the whole category as malware will be routed around within a fortnight.
The point is that a governance model built on approving applications cannot see software that changes shape, permissions and owner between reviews. That model was designed for procurement cycles, and browser AI doesn't have one.
IBM's 2025 Cost of a Data Breach research found that 97% of organisations reporting an AI-related incident lacked proper AI access controls, and 63% had no governance policy capable of managing AI at all.
Those are not organisations without an AI policy. Most of them have one; it just governs a list of applications.
The researcher offered fifty dollars and ended up paying nothing. The question worth taking to your next board meeting is what the equivalent listing for your environment would go for, and who would notice if someone met the asking price.
Your Governance Model Governs a List
.avif)
.avif)
.avif)
.png)
.avif)
.avif)
.avif)
