Atlas Is Dead, So ChatGPT Went Looking Through Your Open Chrome Tabs
OpenAI has upgraded its ChatGPT extension for Google Chrome so the assistant can reach into the tabs you already have open. In ChatGPT's web or desktop app, a user tags Chrome in the prompt, and the model can read the titles and contents of those tabs, pull information out of them, and act on it. The demo OpenAI posted shows someone asking ChatGPT to compare three tabs of sofas they are considering and then draft a comparison sheet. The sample prompts the company listed include filling a registration form from an event brief, adding an appointment to a work and personal calendar, and sorting vendors into a table with pricing, key features and source links. The capability is not always on: it fires only when Chrome is explicitly tagged, and that tag is the switch.
The same update puts ChatGPT into a browser sidebar carrying, in OpenAI's phrasing, the full power of ChatGPT and your entire conversation history in Chat or Work, without leaving the page you are on. ChatGPT Work goes further and can control your Chrome tabs for sending messages, filling out forms and downloading files, as well as organising or grouping open tabs. OpenAI itself frames the feature as comparable to Google's Gemini-powered auto browse. Chrome is not the only target: the extension also covers Edge, Brave, Opera and Vivaldi. All five support tab mentions and browser control, while side chat reaches every one of them except Opera.
The context is that OpenAI's own browser is gone. ChatGPT Atlas launched on October 21, 2025, macOS only, was marked for deprecation on July 9, 2026, and stopped working on August 9, 2026 — 292 days from introduction to shutdown. The product lost on distribution, not on the idea. Rather than drop the browser agent, OpenAI relocated it into the browser people already run, which is why this upgrade reads as Atlas's replacement: the same agentic capability, now delivered through somebody else's permissions dialog.
The price is stated in the permissions. OpenAI's own documentation describes the extension as granting the ability to read and change all your data on all websites, read and change your browsing history on all your signed-in devices, and access the page debugger, plus bookmarks, downloads and tab groups. For ordinary users the payoff is skipping copy-paste: comparing prices, filling forms and sorting a trip without shuffling windows. But open tabs are exactly where personal and professional data concentrates — inboxes, dashboards, medical portals, contracts. One analysis argues the design shows some restraint, since nothing happens without the @Chrome tag and this is not passive surveillance; the flip side is that a single prompt is the only gate.
The security research is not reassuring. A University of Washington paper by Franziska Roesner and David Kohlbrenner tested several agentic browsers and found ChatGPT Atlas in agent mode was the only one successfully attacked for cross-origin data theft; the work appeared at the ICLR 2026 Workshop on Agents in the Wild and was presented on April 26 in Rio de Janeiro. Researcher Gal Weizman's BragJack demonstration went further: using an extension with unremarkable permissions, an attacker can push forged instructions through the browser's own AI communication channel and hijack the agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome. He calls it Prompt Forcing, and it matters because the final action is performed by trusted software, which endpoint defences are not tuned to catch. The flaws were tracked as CVE-2026-0628 (CVSS 8.8) on Chrome and CVE-2026-55945 on Edge, fixed in Chrome 143.0.7499.192 and Edge 150.0.4078.48. In an August 2026 test, Zenity Labs showed that a single planted comment under a popular post was enough to steer Atlas into firing a phishing wave at an entire contact list from the victim's own WhatsApp account.
Rivals are already on this track: Gemini's auto browse is metered by subscription, 20 tasks a day on AI Pro and 200 on Ultra, and gated by region. The more practical difference is on the enterprise side — whether administrators can switch the browser off, set site-level rules, block cookie and password imports, and do so beyond users' override. Years of extension security audits keep landing on one point: too many add-ons request "read and change all your data on all websites," and that permission should be priced as a risk in itself. For users, the real question is not whether ChatGPT can see your tabs but how many agents like this you are willing to keep open at once. The next test is whether OpenAI ships site whitelists, pre-action confirmation and audit logs as defaults rather than as administrator options.