ChatGPT browser extension

The ChatGPT browser extension is an OpenAI extension that lets ChatGPT read and act on websites inside a user’s own browser, including sites where the user is already signed in. OpenAI cites examples such as LinkedIn, Salesforce, Gmail and internal tools.

The user starts the work from the ChatGPT desktop app or from a side chat next to the page. The ChatGPT browser extension therefore runs as a delegated session in a real browser, not as a standalone crawler.

• Asking questions about the page a user is viewing, or about selected text, from the side chat.
• Summarizing a page or, when captions exist, a YouTube video from its timestamped transcript.
• Completing tasks in web apps the user is signed in to, for example updating a CRM account from call notes (OpenAI’s own example).
• Using context from open tabs when a task spans several pages.

In each case a person asked for the task and is the account holder.

Why it’s hard to identify

The usual checks do not transfer from classic bots to the ChatGPT browser extension.

• No documented user-agent or IP range. OpenAI lists user-agents and IP files for GPTBot, OAI-SearchBot, OAI-AdsBot and ChatGPT-User. The extension is not among them in OpenAI’s crawler documentation.  
• It runs in the user’s browser profile. Requests come from the user’s device, within the user’s signed-in sessions.
• Broad browser permissions. OpenAI lists permissions that can appear at install, such as access to the page debugger, reading and changing data on all websites, managing downloads and viewing tab groups. OpenAI notes these make the extension capable of operating browser workflows.
• ChatGPT-User is a different thing. OpenAI says ChatGPT-User is used for certain user actions in ChatGPT, and that robots.txt rules may not apply to it. Do not assume the extension uses the same user-agent.  

A user-agent or IP check alone will not separate a person from an assistant acting for that person.

A user asked the ChatGPT browser extension to. Tasks start when someone selects the browser in the ChatGPT desktop app, mentions an open tab, or opens side chat. By default, OpenAI says ChatGPT asks before it interacts with each new website, based on the host (for example example.com).

Users can choose “Allow once”, “Allow for this site”, “Allow for all sites” or “Decline”, and can keep an allowlist and a blocklist of domains. OpenAI labels “Allow for all sites” and browser history access as elevated risk.

These controls belong to the user. They do not give a website owner a way to opt out.

What it can do on your site

The ChatGPT browser extension can read page content and act where the user is signed in. OpenAI’s documentation also describes file uploads from the computer and download management. OpenAI’s pages reviewed do not say which actions are excluded, such as payments or account changes.  

Do not start from the user-agent. Start from behavior and context.

1. Check what OpenAI publishes first. Confirm whether the traffic matches any listed OpenAI user-agent or IP file. A match points to ChatGPT-User or a crawler, not necessarily the extension.
2. Look at session-level signals. Compare navigation speed, form-fill timing, input patterns and action sequences against normal customers on the same flow. DataDome observations on extension-driven sessions]
3. Look at automation artifacts. The extension requests debugger-level browser access, so check for signs of programmatic control in the session.  
4. Weigh the account. A real, long-standing account doing a sensitive action in an unusual way is a different case from a new account doing the same.
5. Score the action, not only the visitor. Reading a public page and changing an address or password carry different risk.

The answer depends on the page and the action. A blanket block would also stop real customers who use an assistant. A blanket allow ignores sensitive flows.

• Set the policy by action. Decide what an agent-assisted session may do on each page type, using the table above.
• Apply rate limits and step-up checks on login, account and checkout flows.
• Monitor, then tighten. Start by measuring this traffic before blocking, so you do not cut off real customers.
• Do not rely on robots.txt. It governs crawlers and is not documented as applying to the ChatGPT browser extension. 
• If you manage employee devices, OpenAI documents Chromium enterprise policies for the ChatGPT desktop in-app browser through MDM, including extension install controls (OpenAI Help Center, accessed October 30, 2026). These apply to your staff’s use of ChatGPT desktop, not to visitors to your site. 

We treat the ChatGPT browser extension as user-delegated automation, not as a crawler to block on sight. Our default is to allow low-risk reading, limit high-volume access, and challenge sensitive actions such as login, account changes and checkout.

Because the ChatGPT browser extension has no documented user-agent or signature, we look at behavior and the action being taken. DataDome Bot Protect helps you detect and manage automated sessions in real time, and DataDome Agent Trust helps you decide which AI agents to trust and what each may do.