L
← Browser Extensions
Browser Extensions 2026-08-17

Prompt Sentry

Watches for other extensions phoning home while you're on ChatGPT or Claude, and names the one that just did.

Prompt Sentry
Prototype
Open standalone ↗

PromptSentry

Watches for other extensions phoning home while you're on ChatGPT or Claude, and names the one that just did.

Date: 2026-08-17 Form factor: Browser extension (Manifest V3) Browser surface: content script (chatgpt.com, claude.ai), toolbar popup, chrome.webRequest, chrome.management, chrome.storage, chrome.tabs (messaging only) Status: Prototype

What it is

PromptSentry sits quietly until you open an AI chat tab, then watches outbound network traffic for anything initiated by another installed extension. When one calls home, the popup logs which extension it was, what host it contacted, and when, with one click to disable that extension or mark it trusted if the traffic turns out to be legitimate (a sync feature, an ad-block filter update).

Why it has to be an extension

A website can't see what your other extensions are doing. That visibility only exists inside the browser process. PromptSentry uses chrome.webRequest to observe the initiator of every outbound request and checks whether it's a chrome-extension:// origin rather than the page itself. It cross-references the extension ID against chrome.management.getAll() to get a name, and a content script on the chat page drops a small indicator so you can see monitoring is active without opening the popup. None of that is reachable from a page you merely visit.

Who it serves

People who paste real work into ChatGPT or Claude (incident summaries, contract drafts, source code) and have a browser full of extensions installed over the years for reasons they don't fully remember. Three Chrome extensions were caught in 2025 and 2026 doing exactly what PromptSentry watches for: Smart Sidebar quietly POSTed base64-encoded ChatGPT and DeepSeek conversations to an external server, and Urban VPN injected a script that overrode network requests across eight different AI platforms. Between them, those two extensions alone had over 400,000 users.

Why it could be profitable

Free tier: monitors ChatGPT and Claude, keeps the last 15 flagged events, manual review only. Pro ($3.99/month or a $24 one-time unlock): all eight platforms the real-world incidents targeted (adds Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI), unlimited event history, and CSV export. A third tier, team licensing for IT and security leads, is the one with the clearer budget behind it. LayerX's 2026 enterprise report puts AI-extension adoption at roughly one in six enterprise users, with those extensions 60% more likely to carry a known CVE than ordinary ones. A security lead who has to answer "which extensions on our managed fleet are calling out during AI chat sessions" is a much easier sale than an individual user, though that pitch is speculative until there's a pilot customer to point to.

The demand signal here is stronger than most of the extension prototypes we've built: this isn't a hypothetical risk, it's three named incidents from the past year with user counts attached.

How to load it in Chrome

  1. Open chrome://extensions and turn on Developer mode.
  2. Click Load unpacked and select this folder's extension/ directory.
  3. Visit chatgpt.com or claude.ai. A small "PromptSentry monitoring" pill appears in the top-right corner of the page. Open the toolbar icon to see the event log; it stays empty until another installed extension makes a request while that tab is open.

How to try the demo

  1. Open index.html in any modern browser. No server needed; the page loads sample-data.json with a relative fetch().
  2. Click the shield icon in the mock toolbar to open the popup and see the pre-loaded event log.
  3. Wait about six seconds without touching anything. The harness fires a simulated live detection, the corner pill flips red with the offending extension's name, and a new row lands at the top of the popup log.

The demo simulates one thing the real extension does for itself: detecting a live network call from another extension. Everything else is the same code the real extension runs (the popup markup, its styling, its event-log rendering, the disable/trust buttons, the monitoring pill), just reading from sample-data.json in place of chrome.storage and chrome.management.

Permissions, and why each one

Permission Why it's needed
webRequest Observes the initiator and destination of outbound requests so extension-initiated calls can be told apart from the page's own traffic. Read-only; nothing is blocked or modified.
management Resolves an extension ID from webRequest into a name, and disables an extension when you click Disable in the popup.
storage Persists the event log and your trusted-extensions list between browser sessions.
host_permissions: <all_urls> The whole point is catching calls to servers you've never heard of, so the destination host can't be scoped in advance. webRequest needs host permission for every URL it inspects, which means this one has to be broad; see below.

<all_urls> is a real cost, not a formality. It's the single permission worth being honest about in a Chrome Web Store listing. It's mitigated by scope: the listener only records an event when a tab from the two watched domains is currently open, and it never touches request bodies, only the initiator and destination host.

What's in this prototype

  • Content script that arms monitoring on chatgpt.com and claude.ai, and shows a live status pill on the page
  • Background service worker that watches chrome.webRequest, resolves offending extensions via chrome.management, and logs events to chrome.storage.local
  • Popup with an event log, relative timestamps, and working Disable / Trust actions
  • Demo harness with a mock browser window, a seeded 18-event log, a mock ChatGPT conversation, and a live simulated detection about six seconds after load
  • Free-tier framing built into the popup footer (event cap, watched-site count) — Pro checkout is not wired up

Roadmap

  • Add the other six AI chat domains from the Urban VPN incident (Gemini, Copilot, Perplexity, DeepSeek, Grok, Meta AI) behind the Pro gate
  • Ship the CSV export and a real checkout flow for the one-time Pro unlock
  • A managed-fleet mode for the team tier: aggregate events across a Chrome Enterprise deployment via chrome.management policy hooks, not just a single browser
  • Weekly digest email summarizing flagged extensions — needs a backend, not something MV3 can do alone

Sources

Requirements

PromptSentry — Requirements

Goals

  • Detect when an installed extension makes an outbound network request while the user has an AI chat tab open
  • Identify the offending extension by name, not just by opaque ID
  • Give the user a one-click way to act on a flagged extension: disable it or mark it trusted
  • Keep the always-on surveillance narrow: only arm monitoring when a watched AI chat domain is actually open in a tab
  • Make the permission cost visible and honest, especially the broad host permission webRequest requires

Primary user

Someone who uses ChatGPT or Claude for real work (drafting, debugging, summarizing sensitive material) and has accumulated a browser full of extensions over time without auditing what any of them can see. They want to know if one of those extensions is watching their AI conversations, without having to manually inspect network traffic themselves.

Functional requirements

  • FR1: Content script runs on chatgpt.com and claude.ai, injects a fixed-position status pill, and announces the tab to the background service worker on load
  • FR2: Background service worker tracks which tabs are currently "armed" (an AI chat domain is open) in an in-memory map keyed by tab ID
  • FR3: chrome.webRequest.onBeforeRequest listener runs only when at least one tab is armed
  • FR4: A flagged request is one whose initiator starts with chrome-extension:// and is not PromptSentry's own extension ID
  • FR5: The offending extension ID is resolved to a name via chrome.management.get(); unresolvable IDs are logged as "Unknown extension"
  • FR6: Flagged events are stored in chrome.storage.local, capped at the 100 most recent
  • FR7: The toolbar badge shows the current event count and updates within one flagged event
  • FR8: The content script's status pill flips to an alert state and names the offending extension for six seconds after a flag
  • FR9: The popup lists the 15 most recent events with extension name, destination host, and relative time
  • FR10: Popup Disable button calls chrome.management.setEnabled(id, false)
  • FR11: Popup Trust button adds the extension ID to a persisted trusted list; trusted extensions stop generating events
  • FR12: Popup and content script both feature-detect chrome.* availability and fall back to sample-data.json when absent, so the same files run in the demo harness
  • FR13: Manifest declares no permission the code doesn't call

User stories

  • As someone who just pasted a client incident report into ChatGPT, I want to know immediately if another extension tried to read that page, so that I can revoke access before more damage is done.
  • As a user with 20+ installed extensions, I want the offending one named specifically, so that I don't have to guess which one to investigate.
  • As someone who sees a flagged event that turns out to be a legitimate sync feature, I want to mark that extension trusted, so that I stop getting alerted for the same benign behavior.
  • As a security-conscious user, I want to see exactly which permissions this extension itself requests and why, so that I can decide whether to trust the tool that's supposed to be watching for untrustworthy ones.
  • As a first-time visitor to the demo page, I want to see a flagged event happen live, so that I understand what the extension actually does without installing it.

Extension surfaces

  • Content script (chatgpt.com, claude.ai) — injects the monitoring status pill, arms the background listener, and renders the alert state
  • Toolbar popup — shows the event log, current monitoring status, and Disable / Trust actions
  • Background service worker — the only surface with chrome.webRequest and chrome.management access; does the actual detection and storage
  • chrome.storage.local — persists the event log and trusted-extension list between sessions

Non-functional requirements

  • Privacy: PromptSentry itself only records request metadata (extension ID, destination hostname, timestamp), never request or response bodies
  • Permission minimalism: every permission in the manifest maps to a specific feature described in the README's permissions table
  • Performance: the webRequest listener does no work when no AI chat tab is open, so it shouldn't add latency to unrelated browsing
  • Data handling: nothing leaves the browser; there is no remote server in this prototype

Out of scope (for the prototype)

  • The six additional AI platforms named in the Pro tier (Gemini, Copilot, Perplexity, DeepSeek, Grok, Meta AI)
  • CSV export and any real payment/checkout flow
  • Team/fleet aggregation across a managed Chrome deployment
  • Distinguishing malicious exfiltration from benign background sync traffic beyond the user's own trust list

Open questions

  • Should the trusted-extension list be exportable/importable so a security team can pre-seed it across a fleet?
  • Is per-request destination-host allowlisting (e.g., ignore known CDN domains) worth the added complexity, or does it just create blind spots?
  • Does Chrome Web Store review treat <all_urls> + webRequest as acceptable for a security tool, or does it need a narrower opt-in flow via chrome.permissions.request()?

More from Browser Extensions

Scopecreep
Scopecreep
2026-08-15