How to Inventory AI Browser Extensions on Firm Devices

Why do AI browser extensions belong in a firm's security inventory?

AI browser extensions belong in the inventory because they run inside the browser where advisers read client email, open the CRM and use AI chat tools, and many request permission to read every page they touch. An extension with that access can see client data without anyone uploading a file.

AI sidebars, writing assistants and meeting summarizers often need broad site access to do their jobs, which is the same access a malicious extension wants. Researchers at OX Security reported in December 2025 that two extensions impersonating a legitimate AI sidebar, with roughly 900,000 combined users, copied full ChatGPT and DeepSeek conversations and the URLs of open tabs to an outside server every 30 minutes. One of them carried Google's Featured badge. Staff who installed them were doing nothing unusual.

For an RIA or broker-dealer, the issue is client information leaving through a channel the firm never approved and cannot see. Most AI policies cover which chat tools staff may use. Fewer cover the add-ons that sit on top of those tools.

What do the rules expect a firm to know about software on its devices?

Regulation S-P requires written policies and procedures that protect customer information against unauthorized access or use, and a firm cannot protect against software it has never listed. The SEC does not name browser extensions, but an extension that can read client data is one more path those written safeguards should cover.

17 CFR 248.30(a) requires covered institutions to maintain written policies and procedures addressing administrative, technical and physical safeguards for customer information, and an incident response program to detect, respond to and recover from unauthorized access. If an extension is found exfiltrating data, paragraph (a)(4) can come into play: notice to affected individuals is due as soon as practicable, and no later than 30 days after the firm becomes aware that unauthorized access to sensitive customer information has occurred or is reasonably likely to have occurred.

Broker-dealers and dual-registered firms have a second layer. FINRA Regulatory Notice 24-09 reminds members that FINRA rules are technology neutral and that supervision obligations under Rule 3110 apply when firms use generative AI. The SEC Division of Examinations listed cybersecurity, the Regulation S-P amendments and emerging technology, including AI, in its Fiscal Year 2026 Examination Priorities. An examiner asking how the firm controls AI use is a reasonable expectation, and an extension inventory is part of a credible answer.

The CIS Critical Security Controls make the expectation explicit. Safeguard 9.4 calls for restricting unauthorized browser and email client extensions, and Control 2 calls for a software inventory reviewed at least twice a year, with unauthorized software handled monthly.

Where does the inventory data come from?

From the tools that already manage the firm's devices. Microsoft Defender and Chrome Enterprise Core both report installed extensions once devices or browsers are enrolled. The firm's job is to turn that reporting on and pull the list.

• Microsoft Defender Vulnerability Management has a browser extensions inventory that lists extensions in Edge, Chrome and Firefox on Windows devices, the devices and users that have each one, whether it is turned on, the permissions it requests and a permissions risk rating. It requires Defender Vulnerability Management Standalone or the add-on for Defender for Endpoint Plan 2.
• Chrome Enterprise Core is available at no additional cost and includes an apps and extensions usage report showing install counts and requested permissions across enrolled browsers, with third-party risk scores for Chrome Web Store extensions. Reporting must be turned on, and data can take up to 24 hours to appear.
• Microsoft Edge accepts the same style of ExtensionSettings policy used by Chrome, so a firm can manage both browsers from Intune or Group Policy with one approach.

The Defender inventory covers Windows only. Firms with Mac users should enroll Chrome on those machines in Chrome Enterprise Core or confirm that their Mac management tool reports extensions.

How do you inventory AI browser extensions, step by step?

Start with the full list, sort out the AI tools, then decide what stays. Each step produces a record the firm can keep.

• Enroll every browser. Confirm that each firm laptop and desktop reports to Defender, Chrome Enterprise Core or both, and that personal browser profiles on firm devices are covered.
• Export the list. Pull every extension with its ID, name, publisher, version, install count, users and requested permissions into one spreadsheet.
• Tag the AI tools. Flag anything that describes itself as an AI assistant, chatbot, writer, summarizer, transcriber, meeting notetaker or sidebar, plus extensions that add AI features to email or the CRM.
• Rank by access. Extensions that can read and change data on all websites, read browsing history, capture the screen or read the clipboard go to the top. Edge's policy reference notes that blocking a permission stops extensions that require it from loading.
• Check the publisher. Compare each AI extension against the vendor the firm actually approved. The extensions in the OX Security report impersonated a legitimate AI sidebar.
• Decide and document. Mark each item approved, approved with conditions or removed, and record who decided and why. That record is the evidence an examiner will want to see.

How should a firm control extensions once the inventory exists?

Move to an allowlist. Block installation by default, then approve the specific extensions the firm has reviewed. Both major browsers support this through policy.

In Google's admin console, the setting Block all apps, admin manages allowlist limits users to extensions the firm allows, and a variant lets users request extensions for review. In Edge and Chrome, the ExtensionSettings policy can set a default for all extensions, block specific permissions, and stop extensions from touching named sites through runtime_blocked_hosts, up to 100 entries. That last setting is useful for keeping every extension off the CRM, custodial portals and the email client, even approved ones.

Use the removed installation mode for extensions that must come off devices. Microsoft's documentation says removed uninstalls an extension that was installed previously, while blocked only prevents new installs.

Extensions should also be part of the firm's AI approval process. A new AI tool request should name any extension it needs, and approval should cover that extension's permissions and publisher. Pair the allowlist with controls that block personal AI accounts on firm devices, so staff cannot route around it.

What should the firm do this quarter?

Finish one inventory, close the obvious gaps, and put the review on a schedule. The goal for the quarter is a list the CCO can hand an examiner, alongside the other AI supervision evidence the firm keeps.

• Turn on extension reporting in Defender or Chrome Enterprise Core and export the first list.
• Remove AI extensions that are unapproved or come from publishers the firm cannot verify.
• Block installation by default and publish an allowlist with a request process.
• Add runtime_blocked_hosts entries for the CRM, custodian portals and email.
• Add extensions to the written Regulation S-P safeguards procedures and, for broker-dealers, the supervisory procedures.
• Schedule the inventory review at least twice a year, matching CIS Safeguard 2.1, and recheck monthly for unauthorized items.

If an extension is found sending data outside the firm, treat it as a possible incident under the firm's incident response program and bring in counsel to assess notice obligations. A malicious extension is a useful scenario for the next Reg S-P tabletop exercise.

How does s90 help?

s90 runs extension inventories for advisory firms and broker-dealers as part of its new-app alerts and AI guardrails. We turn on browser reporting, flag new AI extensions as they appear, maintain the allowlist and keep the review record your CCO needs for an exam. If you want to see what is installed across your firm today, we can start with a one-time inventory.