Skip to content
Call wiki

What can an AI do in your browser, and how do you keep it away from sensitive sites?

Last updated 2026-08-17 · Confidence: documented — Anthropic’s help center and OpenAI’s Codex docs; the speed observation is a first-hand call report; the site-blocks-don’t-touch-connectors claim is inferred.

A browser agent can do roughly whatever you can do on a website — read, click, type, fill forms, manage tabs — through either your real signed-in Chrome or a credential-less embedded browser. Site permissions are the containment lever, and blocking a site there does not affect connectors.

Your Chrome vs. an embedded browser

Section titled “Your Chrome vs. an embedded browser”

Claude in Chrome lets Claude “read, click, and navigate websites”, fill forms, switch tabs, and read console output, launched from the Chrome side panel, Cowork, or Claude Code — all paid plans. It drives your real profile, so it acts with your logins.

Codex makes the same split explicit: its built-in browser “keeps browsing work inside ChatGPT without using your Chrome profile”, while its Chrome extension exists for sites needing your signed-in state (Gmail, internal tools). The embedded browser risks no credentials; the extension reaches everything you’re logged into.

Either way it works by screenshot-and-click, so it’s slow — first-hand use found it able to finish anything clickable (flight check-in, cookie banners) but far slower than a connector or API route (tried — dated call reports, 2026-06/08). Treat it as the fallback for sites nothing else reaches.

Keeping it off sensitive sites

Section titled “Keeping it off sensitive sites”
  • Claude asks per site; even “always allow” sites re-prompt for protected actions — downloads, sensitive data entry, authorizations — and categories like banking, trading, and crypto are blocked outright.
  • You can revoke per-site permissions in extension settings; for an individual who browses widely, blocking the few sites that must stay off-limits is lighter than maintaining an allowlist.
  • Org admins set allowlists/blocklists that override user permissions. Team plans ship with the extension enabled by default; Enterprise disabled until an admin turns it on. Anthropic recommends orgs “start with a restrictive allowlist”.
  • Codex keeps its allowlist and blocklist under Settings > Computer Use.

Blocking drive.google.com does not disable the Drive connector: connectors reach Google through API calls made server-side, not through your browser. Scoping what a connector itself sees is a separate problem — see Connector scoping; for what protects you once an agent has this reach, see Agent safeguards.

Q&A from calls

Section titled “Q&A from calls”

Can an AI read Apple Notes? No connector exists, but notes sync to icloud.com/notes — a browser agent in a Chrome signed into your Apple account can read and search them there. Password-locked notes stay hidden. Note the trade-off: this route hands the agent a fully signed-in Apple account, not just the notes.

Sources

Section titled “Sources”