Your Company's Biggest Cybersecurity Threat Could Be an AI Tool Your Staff Loves
It could, and it would not look like an attack. The AI tools staff love most, browser extensions that summarise pages, AI browsers that act on your behalf, transcription bots that join meetings, free apps that "chat with your PDF", often get broad access to email, documents and every web page an employee opens. In late 2025, security firm OX Security found two Chrome extensions with more than 900,000 users between them, one carrying Google's "Featured" badge, quietly sending users' ChatGPT and DeepSeek conversations and browsing history to an outside server every 30 minutes. Brave showed that hidden text on a web page could make the Perplexity Comet AI browser read a user's email and help hijack their account. These are not malware in the usual sense; staff install them willingly. The controls that work combine an approved-tools list, browser and device management, and network visibility from a firewall such as a Fortinet FortiGate.
Which AI tools create the most risk?
| Tool type | What it can access | Documented problem |
|---|---|---|
| AI browser extensions | Every page the user views, often including email and internal web apps | Two extensions with 600,000+ and 300,000+ users exfiltrated ChatGPT and DeepSeek chats and open-tab URLs (OX Security, Dec 2025) |
| AI browsers and agents | Logged-in sessions, with permission to click, type and submit | Prompt injection in Perplexity Comet led to email and one-time-password theft (Brave, Aug 2025); OpenAI's CISO called prompt injection "a frontier, unsolved security problem" (Oct 2025) |
| Meeting transcription bots | Audio, video, chat and shared screens of confidential meetings | Transcripts stored outside the company; see The Meeting Was Confidential. So Why Is There an AI Transcript? |
| "Connect your account" AI apps | Mailbox, calendar or cloud drive through an OAuth grant | Access continues after the user stops using the app, until the grant is revoked |
| Personal chatbot accounts | Whatever is pasted or uploaded | Netskope found 223 generative AI data-policy violations per organisation per month (Jan 2026) |
Examples from the named security researchers' reports.
Why are these tools so hard to spot?
They run inside approved software. An extension lives inside Chrome or Edge; an OAuth app lives inside Microsoft 365 or Google Workspace; an AI browser looks like a browser. Antivirus does not flag them because they are not malicious when installed, and some only turn bad after an update or a change of owner. The traffic goes to legitimate-looking cloud services over HTTPS. And staff rarely mention them, because they are useful. IBM's 2025 Cost of a Data Breach Report found only 34% of organisations with AI policies actually audit for unsanctioned AI.
The riskiest AI tool in your office is the one that is genuinely helpful, has broad permissions and that nobody approved.
What controls actually work?
- Control browser extensions centrally. Chrome and Edge both support allow-lists through Microsoft Intune, Google admin or group policy. Allow the extensions you approve; block the rest.
- Review app consents. In Microsoft 365 or Google Workspace, restrict which third-party apps users may connect, and review existing grants quarterly.
- Treat AI browsers and agents as privileged software. Do not let them run in sessions logged into email, banking or admin consoles until your IT team has approved them.
- Get network visibility. FortiGate application control, included with FortiCare support, identifies generative AI applications and lets you allow, block or restrict them. FortiOS 8.0 adds detection of the MCP and A2A protocols used by AI agents. Web and DNS filtering in the UTP bundle catches new AI sites by category.
- Watch for data leaving. Data loss prevention, which Fortinet lists in the Enterprise Protection bundle, can flag NRIC or card numbers in uploads, usually with SSL inspection switched on.
- Offer a good approved alternative, so staff do not need the risky one.
A quick audit you can run this month
- Export the list of browser extensions installed across company devices from your device management tool.
- Export the list of third-party apps with access to company mailboxes and drives.
- Pull a month of FortiGate application logs filtered to the generative AI category.
- Ask each team which AI tools they rely on, without blame.
- Approve, replace or remove each one, and write the result into your AI policy.
For the data side of the same problem, see Your Employees Are Using ChatGPT. But Is Your Company Data Safe?, and for unmanaged hardware, The Most Dangerous Device in Your Office Might Be the One Nobody Manages.
Buying in Singapore
SourceIT supplies FortiGate firewalls for network visibility and control of AI apps, including the FortiGate 50G (S$1,819.20 with 1-year UTP), FortiGate 70G (S$2,630.40) and FortiGate 90G (S$6,094.80), and Microsoft 365 business plans, including Business Premium with Intune for device and browser management. Prices listed 30 Oct 2026. Browse the FortiGate firewall collection or Microsoft 365 for Business. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Are AI browser extensions safe? Not automatically. In late 2025, two AI extensions with more than 900,000 combined users were found sending users' chatbot conversations and browsing data to an outside server. Approve extensions centrally.
What is prompt injection in AI browsers? Hidden instructions on a web page that an AI assistant reads and follows, for example to fetch the user's email. Brave demonstrated this against Perplexity Comet in 2025.
How do I find out which AI tools staff are using? Combine device-management reports of installed extensions, a review of connected apps in Microsoft 365 or Google Workspace, and firewall application logs filtered to generative AI.
Can FortiGate detect AI apps and agents? FortiGate application control identifies generative AI applications, and FortiOS 8.0 can detect the MCP and A2A agent protocols. Application control is included with FortiCare.
Should companies block all AI extensions? Block by default and allow approved ones. A total ban tends to push staff to personal devices, where you have no visibility at all.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
