Shadow AIAI SecurityThreat Intelligence
Extension review, where it happens at all, is a permissions exercise. Someone opens the manifest, reads what the extension is asking for, and decides whether the ask is proportionate to what the thing does. A password manager wanting access to every site is fine. A unit converter wanting the same thing is not.
That method stops working the moment a legitimate product category needs the maximal grant to function. This week produced a clean illustration of what that costs.
SOCRadar's Threat Research Unit published an analysis of PEEP, a Chromium post-exploitation toolkit that ships as an extension called Smart Bookmarks, version 1.3.0. The Hacker News covered the disclosure on September 7, 2026, and GBHackers published a technical breakdown of the same research. It is built on RedExt, an open-source Manifest V3 red-team framework — a browser extension plus a Flask command-and-control server, published for authorised engagements and repurposed here with Chinese-language artefacts left in the source.
The manifest it presents is the part worth sitting with.
Cookies. Tabs. History. Downloads. Scripting. Proxy settings. Native messaging. Every HTTP and HTTPS origin.
Now describe, from the manifest alone, the difference between that and an AI browser assistant.
You cannot, because there isn't one that a reviewer can act on. An in-browser AI sidebar that summarises the page you are reading needs scripting and all-origins access — reading the page is the product. It needs tabs to know what you are looking at. If it can act inside authenticated applications on your behalf — file the ticket, draft the reply, pull the record — it needs your session. The AI assistant category does not request broad permissions because it is badly built. It requests them because the feature is impossible without them.
Which means the manifest, as a classifier, has been quietly retired. Everything in the "reads everything you do" tier now looks alike, and the tier is no longer small or exotic. It is where a fast-growing share of the AI tools your staff install voluntarily now live.
The permission most people skim is the one that matters most here.
PEEP registers a companion executable, nm_host.exe, as the native messaging host com.peep.lab. Native messaging is a documented Chromium feature: it lets an extension exchange messages with a program installed on the host, deliberately, outside the browser sandbox. Through it, PEEP's operators run shell commands, enumerate processes and services, list directories, read and write files, hunt for sensitive documents, and rename, hash or delete paths.
That is not browser telemetry. That is a remote access tool whose front end happens to render in a tab.
The automatic exfiltration is the smaller half: browsing history, open tabs and active URLs, session cookies, form data, clipboard contents, screenshots, local and session storage, public IP, locale, timezone and User-Agent. The agent polls its C2 every 30 seconds over plaintext HTTP — 206.237.30[.]232, hosted at Cloudie Limited in Hong Kong, and xfjcc[.]fun with newadmin and newapi subdomains — hitting /api/register, /api/commands and /api/exfil. An exposed /health endpoint showed 34 agent entries, 10 active sessions and 507 data records at the time of analysis, which reads like test infrastructure rather than a mature campaign. Treat the scale as unconfirmed and the tradecraft as the finding.
PEEP is post-compromise. It has no initial access vector of its own; the operator needs administrative or code execution access on the machine first. What it does with that access is instructive.
Rather than publishing to the Web Store and waiting for installs, the toolkit writes itself directly into Chrome and Edge profiles and then forges Chromium's own integrity values — the per-entry HMACs and the top-level super_mac in Secure Preferences — so the browser reads the modified extension settings as legitimate. PowerShell helpers (install_silent.ps1, patch_secure_prefs.ps1, force_enable.ps1) automate it, ExtensionInstallForcelist policy is abused where available, and a Python script covers Linux profiles.
So there is no consent prompt, no store listing, and no warning banner. The extension simply exists, enabled, in a profile.
We wrote three weeks ago about attackers abandoning credential theft in favour of taking the live session — driving the browser that is already logged in, past MFA and App-Bound Encryption. PEEP is the tenancy version of the same move. It does not visit to steal a session. It moves in and holds every session, indefinitely, and gets host command execution as part of the lease.
Yesterday's story was an AI compute service nobody had on a vendor list, because it was enabled from a checkbox in an IDE rather than through procurement. Extensions are the same failure a layer down, and worse: nothing was signed, nothing was expensed, and there is no invoice to find later.
Four things are worth doing this week, and none of them are large:
Software\Google\Chrome\NativeMessagingHosts, in ~/Library/Application Support/Google/Chrome/NativeMessagingHosts, and in ~/.config/google-chrome/NativeMessagingHosts. In most organisations this list is short — a handful of password managers and video plugins — which makes an unexpected entry unusually high-signal. Any AI extension that appears here is asking to run code outside the browser, and should be treated as endpoint software, not as an extension.chrome.exe is not modern browsing behaviour.Nothing in a governance platform stops PEEP. It arrives after the machine is already lost, and the fix at that point is endpoint work.
What governance changes is how many people needed a maximal-permission AI extension in the first place — because that population is what makes the browser profile unreviewable.
Obichat exists to shrink it. It is a governed AI workspace built on LibreChat: employees sign in through the identity provider you already run, the model providers are connected once at the workspace level, and the AI runs server-side. To the endpoint it is an ordinary authenticated web application with no special browser privileges — no all-origins grant, no cookie access, no native messaging host, nothing installed. For the large majority of staff whose AI needs are writing, analysis, summarising and research, that removes the reason to install anything at all. Workspaces are scoped private or team-wide, admin-gated, and every workspace carries an activity record you can export — so instead of an extension inventory that changes whenever someone clicks Add to Chrome, you have one surface, one sign-in path, and one log. It deploys in your own AWS, Azure or GCP tenant where the data cannot leave your perimeter.
The honest caveat is that some people genuinely need AI inside the browser, and developers will keep running local agents whatever policy says. Those are the cases where the endpoint is a credential store, which we argued when a malicious .git config turned seven coding agents into code execution. For them the control is binding rather than removal: Governance AI issues provider credentials through allow-lists tied to specific models, tools, domains and invoking identities, so a token lifted from a profile does not work from somewhere else, and the audit ledger records what that credential actually did — append-only, streaming to your SIEM, written outside the machine that might be lying. That ledger is also what makes the native-messaging and beacon hunts above answerable rather than theoretical when Obiguard SOC picks them up.
The extension your security team would have flagged and the extension your staff installed to summarise PDFs request the same things, and the malicious one skipped the prompt entirely. The permission dialog was never the control you thought it was. The control is deciding, in advance, which AI tools your organisation has — and giving people a good enough one that they stop shopping.
Explore Obichat or talk to us about how many AI browser extensions are installed across your estate right now — and whether anyone could produce that list today.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →