productivity

Best AI Chrome Extensions

Compare the best AI Chrome extensions in 2026 — Claude in Chrome, the ChatGPT extension, Monica, Sider, Merlin, HARPA AI, Grammarly, QuillBot, Otter.ai, Scribe and Perplexity — with list pricing, permission requirements, the full 2026 malicious-extension disclosure record and a verdict for every use case.

Updated August 2026

Quick answer: The best AI Chrome extension in August 2026 is Claude in Chrome, because it is the only extension in this guide that can complete multi-step browser tasks autonomously and publishes measured prompt-injection attack success rates to back the claim. If you want one sidebar that gives you several frontier models without a per-lab subscription, Monica is the better answer at $9.90 per month. For turning a browser workflow into a written procedure, nothing beats Scribe, which is free for unlimited guides. The caveat that overrides all of the above: AI-branded extensions drew sustained, targeted abuse in 2026, with five separate research disclosures between January and August — the two largest covering 900,000 and 260,000 installs on their own — so install first-party extensions from the vendor’s own listing and treat everything else as third-party software that can read every page you open.

This guide covers extensions you add to Chrome. That is a different job from a browser built around a model, which is covered on best AI browsers, a different job from answering a query with sourced links, which is covered on best AI search engines, and a different job from an agent that runs tasks outside the browser, which is covered on best AI agents. Gemini in Chrome is deliberately excluded because it is not an extension — see the section below. Every price here is list price in US dollars. Where a figure comes from a vendor’s own pricing page or announcement we say so; where it comes from a third-party tracker we say that too, because several of these tools change pricing without publishing a changelog.

The state of AI Chrome extensions: August 2026

Six things changed this category in the last twelve months, and three of them were security events rather than product launches.

The two biggest AI labs both shipped official Chrome extensions. OpenAI launched its own ChatGPT Chrome extension in July 2026, in the same fortnight that it began retiring the standalone ChatGPT Atlas browser, which stopped working on 9 August 2026. Anthropic moved Claude in Chrome from pilot to general availability on 26 August 2026, two days before this page was written (Anthropic). For the first eighteen months of this category, “AI Chrome extension” meant a third-party wrapper around somebody else’s API. As of August 2026 it usually means a first-party product from the lab that trained the model.

The strategic logic is the same one that killed the AI browser. Both OpenAI and Microsoft concluded in 2026 that browser AI is a feature rather than a destination — OpenAI shut Atlas and shipped an extension, Microsoft retired Copilot Mode in Edge on 13 May 2026 and folded the features into Edge itself. The extension is where the surviving strategy landed, because it reaches the roughly 68 per cent of the global browser market already using Chrome — and roughly 70 per cent of the desktop market, per StatCounter in July 2026 — without asking anyone to change browser.

Google raised the floor on what an extension may collect. Google published new Chrome Web Store policies on 1 July 2026 and gave developers until 1 August 2026 to comply (Chrome for Developers). Extensions must now limit data collection to what is strictly necessary for their disclosed single purpose, must proactively disclose any change to data handling after install, and may not facilitate prediction-market betting or circumvent AI safety features. The AI-jailbreak ban is the first Chrome Web Store policy written specifically about AI products.

AI-branded extensions drew sustained, targeted abuse. Five separate disclosures in 2026 covered malicious extensions posing as AI assistants: OX Security found two impersonating AITOPIA with over 900,000 combined downloads in January, LayerX found 32 sharing one codebase with at least 260,000 users in February, Unit 42 reported 18 high-risk AI extensions to Google in April, Microsoft found a Perplexity typosquat intercepting searches in June, and Netskope found a previously banned extension back on the store shipping a new payload in August. Details and citations are in the security section below. This is not a footnote to the category — it is the single most important thing to understand before installing anything here.

The extension may not be the end state either. On the same day Claude in Chrome reached general availability, Anthropic also shipped a built-in browser inside Claude Cowork (Anthropic, 26 August 2026), and the Chrome side panel now runs as a Cowork session on Max and Team plans. So the company that just made the strongest case for the extension form factor is simultaneously building a browsing surface of its own. Read the 2026 consensus as “the browser is a feature” rather than “the extension has won”, because the labs are still hedging.

Chrome’s own AI panel turned out to be attackable through extensions. Unit 42 disclosed CVE-2026-0628 on 2 March 2026: an extension holding only the ordinary declarativeNetRequest permission could inject JavaScript into the Gemini panel baked into Chrome and inherit its privileges, reaching the camera, the microphone, local files and screenshots of any HTTPS page without user interaction (Unit 42). Google was notified on 23 October 2025 and shipped a fix in early January 2026, before publication. The lesson generalises: an extension you install and the AI baked into your browser share a privilege boundary that is newer and thinner than it looks.

Gemini in Chrome is not an extension

The highest-volume search in this category returns a product that does not belong in the ranking. Gemini in Chrome is built into the browser, not installed from the Chrome Web Store. Google shipped the Gemini side panel and auto browse into Chrome on 28 January 2026 on Windows, macOS and Chromebook Plus, and announced the Android version on 12 May 2026. The side panel is free; auto browse, the agentic part, requires a Google AI Pro or Ultra subscription and launched as a US preview. There is nothing to install, and any Chrome Web Store listing calling itself “Gemini for Chrome” is by definition not Google’s.

That distinction is load-bearing for safety. LayerX’s February 2026 campaign included an extension called Gemini AI Sidebar with 80,000 users that was removed and re-uploaded under a new ID. If you want Gemini in your browser, update Chrome. If you want Gemini in a sidebar on a browser that is not Chrome, that is a browser decision — see best AI browsers and the Gemini app page.

The four types of AI Chrome extension

Match the type to the job before comparing products. Most of the disappointment in this category comes from installing a type-two sidebar when the job actually needed a type-four specialist.

Type one is where the quality is in 2026. Type two is where the value is. Type four is where the retention is, because a specialist that does one job well rarely gets uninstalled.

Best AI Chrome extensions ranked (August 2026)

Ranked by overall usefulness to a general user today, weighting capability, price, permission footprint, publisher accountability and how likely the product is to still exist in a year. Prices are list and monthly unless stated.

The eleven best AI Chrome extensions reviewed

1. Claude in Chrome — best overall, and the only one publishing attack numbers

Price: No free tier. Included with every paid Claude plan: Pro $20 per month or $17 per month billed annually at $200 up front, Max 5x $100 per month, Max 20x $200 per month, Team $25 per seat monthly or $20 annually, Enterprise $20 per seat per month billed annually plus usage at API rates (Anthropic) Platforms: Google Chrome on desktop only Model: Claude Sonnet 5, Opus 5 and Fable 5 depending on plan; Mythos 5 access is restricted and not included with a standard consumer plan Key features: Reads the active page, works across tabs, clicks, types, navigates and fills forms using your existing logins, autonomous action approval, conversation continues in the desktop, mobile and web apps

Claude in Chrome reached general availability on 26 August 2026 after roughly a year in pilot, and the headline change at GA was autonomy: Claude now approves safe actions itself instead of asking you to confirm each one, with a classifier checking every action against your original request before it runs (Anthropic). The stated use case is the honest one — internal dashboards, legacy systems and vendor portals that have no API and therefore no connector.

Why it wins: It is the only extension in this guide that publishes measured prompt-injection resistance rather than asserting it. On Anthropic’s current evaluation, using attacks sourced from professional red-teamers, attacks that reached the model succeeded 17.6 per cent of the time against Claude Opus 4.5 and 3.8 per cent against Claude Opus 5 with no additional safeguards. With probes and the safety classifier running, no attacks succeeded against Claude Sonnet 5, Claude Opus 5 or Claude Mythos 5, and 0.3 per cent succeeded against Claude Fable 5. Anthropic states it has manually verified that every successful break was low-severity. Those are the only numbers of their kind in this category, from any vendor, and they are what separates a browser agent you can reason about from one you cannot.

Limitations: The distribution is narrow and the price floor is real. There is no free tier, so the cheapest way in is an annual Claude Pro plan, which Anthropic prices at $17 per month billed as $200 up front. Anthropic sells Max monthly only, with no annual option. It does not run on other Chromium browsers — not Edge, not Brave, not Opera — and it does not run on mobile. It cannot touch files on your computer or other applications; that remains the desktop app’s job. And Anthropic is explicit that prompt injection “remains a moving target”, so a 0 per cent figure describes today’s attack library, not a solved problem.

Best for: Anyone who already pays for Claude and has repetitive browser work inside a system that will never have an API. See Claude for how the underlying assistant compares elsewhere.

2. ChatGPT Chrome extension — best if your work already lives in ChatGPT

Price: Free to install. OpenAI states availability may depend on your plan, region, device, browser and workspace settings, and has not published specific tier requirements Platforms: Google Chrome on desktop Model: Not separately disclosed; follows your ChatGPT plan Key features: Sidebar that reads the active page, context across open tabs, question answering and summarisation without copy-paste, hooks into ChatGPT’s longer-running agent tasks

This extension is OpenAI’s answer to a strategic retreat. OpenAI announced on 9 July 2026 that it was deprecating ChatGPT Atlas, Atlas stopped working on 9 August 2026 after 292 days of life, and agentic browsing moved into the ChatGPT desktop app and into this extension instead. The product reasoning was blunt and, in hindsight, correct: the browser is a feature, not a destination.

Why it matters: Reach. ChatGPT is the most-used AI assistant in the world, and this extension puts it on the page you are reading without asking you to change browser or open a new tab. If your notes, custom instructions, memory and history already live in ChatGPT, no third-party sidebar can match that continuity, because a sidebar reselling GPT through an API does not see any of it.

Limitations: Availability is the problem. OpenAI’s own help documentation says access depends on plan, region, device, browser and workspace settings, and it has not published which plans qualify — so unlike Claude in Chrome, you cannot know before you try. Work and school workspace users may need an administrator to enable it. Install it only from OpenAI’s own Chrome Web Store publisher listing; more counterfeit extensions impersonate ChatGPT than any other AI brand.

Best for: Existing ChatGPT Plus and Pro subscribers who want page context without changing anything else. See ChatGPT for the underlying assistant.

3. Monica — best multi-model sidebar overall

Price: Free tier. Pro $9.90 per month, Max $24.90 per month, Ultra $99.90 per month (third-party pricing tracker, checked July 2026 — Monica does not publish a dated changelog) Platforms: Chrome and other Chromium browsers Models: Multiple frontier models including GPT, Claude and Gemini families, drawn from one credit pool Key features: Sidebar chat on any page, model switching, translation, writing tools, image generation, page and video summarisation

Monica is the default recommendation for anyone who wants several frontier models without three subscriptions. At $9.90 per month for Pro, it undercuts a single first-party plan by half while giving you access to more than one lab’s models, which is the entire argument for the category.

Why it wins: Price per model. One $9.90 plan against $20 for Claude Pro plus $20 for ChatGPT Plus is not a close comparison on cost, and for the common jobs — summarise this, translate this, rewrite this — the model choice matters less than having any good model one click away.

Limitations: Credits, not access. Monica moved to an advanced credits system in January 2026 under which frontier models consume credits faster than lighter ones, so “access to GPT and Claude” and “unlimited use of GPT and Claude” are very different things on the same plan. You are also inserting a third party between you and the model: your page content and prompts pass through Monica’s infrastructure rather than going straight to the lab, which is a materially different privacy posture from a first-party extension. Monica’s published pricing has changed more than once in 2026 and we could not find a vendor-dated pricing history, so confirm the current number on Monica’s own page before subscribing.

Best for: People who want frontier-model help on any page and are not committed to one lab.

4. Sider — cheapest credible way into a paid AI sidebar

Price: Free plan with 30 basic credits per day. Starter $4.20, Basic $6.70, Pro $12.40, Unlimited $16.70 per month, all on annual billing (third-party pricing trackers, checked August 2026 — Sider’s own pricing page renders its tiers client-side and returned no figures to us) Platforms: Chrome and other Chromium browsers Models: Models from several labs; Sider does not publish a current count Key features: Sidebar chat, highlight-to-ask, YouTube and page summarisation, three-tier credit system separating light models, premium models and agent features

Sider does the same job as Monica for less money, with a more legible pricing ladder. The three credit types — basic for lightweight models, advanced for premium models, elite for agent features — are unusually honest about what you are actually buying, which in this category is rate-limited access rather than a product.

Why it wins: Starter at $4.20 per month is the cheapest paid entry point in this guide by a wide margin, and the three-way credit split makes it unusually clear which tier buys which class of model.

Limitations: The “Unlimited” plan is not unlimited. Sider markets unlimited basic and advanced credits at $16.70 per month; third-party trackers report a monthly credit cap on that tier that does not roll over. Sider reports unlimited; independent trackers report a cap, and Sider does not publish a server-rendered pricing page we could check against. The free plan’s 30 basic credits per day covers occasional highlights and the odd YouTube summary and nothing more; treat it as a trial, not a tier. The same third-party-in-the-middle privacy caveat that applies to Monica applies here. Sider’s model list moves frequently and specific model names quoted on review sites go stale within weeks, so check the current list rather than trusting a comparison table.

Best for: Anyone testing whether an AI sidebar earns a place in their workflow before committing $20 a month to a lab.

5. Grammarly — best task specialist, and the one most people already have

Price: Free. Grammarly Pro $12 per month billed annually, $30 billed monthly. The Superhuman business bundle is roughly $33 per member per month billed annually (third-party pricing summaries, checked April to August 2026) Platforms: Chrome and Microsoft Edge extensions, plus Mac and Windows apps Key features: Grammar, clarity and tone rewriting in any text field, generative writing, plus Superhuman Go with connector and partner agents

The naming needs clearing up first. On 29 October 2025 the company renamed itself from Grammarly to Superhuman — the company, not the writing product, which is still called Grammarly (Superhuman). The suite now bundles the Grammarly writing assistant, Superhuman Mail, Superhuman Docs (formerly Coda) and an assistant called Superhuman Go, which is available on the Grammarly browser extension for Chrome and Edge.

Why it wins: Ubiquity and restraint. Grammarly works in every text field on the web, needs no prompting, and has been shipping since 2009 without being the extension in the security headlines. In a category where the main risk is handing page-reading permissions to an anonymous publisher, an established company with a real corporate identity is worth something concrete.

Limitations: The monthly price is punitive — $30 monthly against $12 annually is a 150 per cent premium for flexibility, one of the harshest annual-versus-monthly gaps in this guide. The rebrand has made pricing pages genuinely confusing, and the tier that unlocks Superhuman Mail is a different, more expensive product from the writing assistant most people mean by “Grammarly”. Free-tier suggestions are noticeably thinner than they were before the generative features moved behind Pro.

Best for: Anyone who writes in a browser and wants one thing that always works. Compare full writing tools on best AI for writing.

6. Perplexity — best for cited answers about the page you are on

Price: Free. Perplexity Pro $20 per month or $200 per year, Perplexity Max $200 per month. Comet Plus, the $5 publisher-content add-on, is included at no extra cost with Pro and Max and is not a tier of the extension Platforms: Chrome extension, plus the Comet browser on Windows, macOS, Android and iOS Key features: Search with inline citations, page-aware questioning, shopping assistance, Comet browser integration

Perplexity’s argument is citation behaviour, and it is an evidence-backed one: Perplexity recorded the lowest citation failure rate of the eight engines in the Tow Center for Digital Journalism’s March 2025 controlled study, at 37 per cent. That is the same evidence behind its position on our best AI search engines page.

Why it matters: If the job is “check whether what this page claims is true”, a tool that shows its sources beats a tool that summarises confidently. Perplexity’s free tier is also usable for this job without any subscription at all.

Limitations: Perplexity’s strategic centre of gravity is the Comet browser, not the extension, and the extension is the thinner product. There is also a brand-safety problem the company did not create: on 29 June 2026 Microsoft’s Defender Security Research Team disclosed a Chrome extension called “Search for perplexity ai” that impersonated Perplexity, changed the default search engine and routed search queries and address-bar input through an attacker-controlled server, capturing them along with browser headers and IP addresses, before redirecting users to real results (The Hacker News). Google removed it after responsible disclosure. Install only from Perplexity’s own listing.

Best for: Research and fact-checking inside a normal Chrome session. See Perplexity for the full product.

7. HARPA AI — best for automation, monitoring and repeatable jobs

Price: Free DEMO plan limited to 10 messages per day and a lifetime cap of around 100 command runs. Paid plans from $12 per month billed annually (“for Everyone”), $19 per month billed annually (“for Pros”), or $240 paid once (“for Life”). API connections, which are what let you bring your own model keys, are listed only on the paid tiers (HARPA, checked August 2026) Platforms: Chrome Models: Connects to GPT, Claude, Gemini and Grok, or to your own API keys Key features: A large prebuilt command library, which HARPA markets as more than 100 commands, plus no-code browser automation, price tracking, website change monitoring, data extraction, form filling and scheduled runs

HARPA is the only extension here whose primary unit of work is a job rather than a question. It monitors pages for changes, tracks prices, extracts structured data, fills forms and runs scheduled commands, which puts it closer to no-code RPA than to a chat sidebar. HARPA’s own site claims it is trusted by 500,000 professionals; that is a vendor claim we could not independently verify.

Why it wins: Bring-your-own-key. HARPA can run against your own API keys, which is the only configuration in this guide where your prompts and page content go to the model provider without a reseller in the middle. For anyone with a compliance objection to third-party sidebars, that is the answer — though note the configuration requires a paid plan, because HARPA lists API connections only on its paid tiers.

Limitations: The permission footprint is the largest here by necessity — an extension that watches pages, extracts data and fills forms across all sites needs broad host permissions, and broad host permissions are exactly what the 2026 malicious-extension campaigns abused. That is not a criticism of HARPA specifically; it is the price of the capability, and it means the publisher-trust question matters more here than anywhere else on this page. The free DEMO plan is not a usable tier: 10 messages a day and a lifetime cap of roughly 100 command runs make it a trial. The learning curve is also real — the command library rewards setup time and punishes casual use.

Best for: Competitor tracking, price monitoring and any browser job you do more than once a week.

8. Scribe — best for turning a browser workflow into documentation

Price: Free forever with unlimited guides and web capture through the Chrome extension. Pro Personal $25 per seat per month billed annually, $35 monthly. Pro Team $13 per seat per month billed annually, $17 monthly, minimum five seats. Enterprise on quote (Scribe’s own pricing page, checked August 2026) Platforms: Chrome extension; desktop capture on paid plans Key features: Records a process as you perform it and generates a step-by-step guide with annotated screenshots, numbered instructions and a shareable link or embed

Scribe solves a problem no chat sidebar touches. You perform a task once with the extension recording, and it produces a written procedure with screenshots at each step. The output is the artefact — a guide a colleague can follow — rather than an answer you then have to write up.

Why it wins: The free tier is genuinely useful rather than a trial. Unlimited guides, web capture, basic editing and link or embed sharing at $0 is more than most free tiers in this guide offer, and enough to document a process end to end if all you need to do is share a link.

Limitations: The free tier is capped on capability, not volume, and the caps matter more than the marketing suggests. Scribe’s own plan comparison puts PDF, HTML, Markdown and Microsoft Word export, redaction, custom branding and Confluence integration above the free tier — so a free guide can be shared as a link but not exported as a document, which is how most organisations actually distribute a procedure. Free-tier capture is also web-only; documenting anything outside a browser tab requires a paid plan. The Pro Personal price is the highest single-seat figure here at $25 per seat per month annually, and the Pro Team discount to $13 requires five seats, which excludes freelancers and small teams from the better rate.

Best for: Anyone who has ever been asked to write down how to do something. Onboarding, support runbooks and internal process documentation.

9. Otter.ai — best for meetings that happen in a browser tab

Price: Basic free with 300 minutes per month. Pro $8.33 per user per month billed annually, $16.99 monthly, 1,200 minutes. Business $19.99 per user per month billed annually, $30 monthly, with unlimited meeting transcription. Enterprise on quote (third-party pricing summaries, checked August 2026) Platforms: Chrome extension, plus web and mobile apps Key features: Real-time transcription of Google Meet, Zoom and Microsoft Teams, searchable notes, automatic summaries and action items

Otter’s Chrome extension captures audio from meetings running in a browser tab and produces a searchable transcript with a summary and extracted action items. It is the most mature product in its niche and the transcription quality is the reason, not the AI summarisation on top of it.

Why it wins: The free tier’s 300 monthly minutes is enough to cover a light meeting load permanently, and the Pro tier’s 1,200 minutes at $8.33 annually is the cheapest serious transcription allowance in this guide.

Limitations: The minute caps are the product, and they bite quickly — 1,200 minutes is twenty hours, which a single week of back-to-back calls will exhaust. Unlimited transcription only arrives at Business, at $19.99 per user per month annually. Recording a meeting also raises consent obligations that vary by jurisdiction; in two-party-consent regions you must tell participants, and the extension will not do that for you.

Best for: Individuals and small teams whose meetings happen in Meet, Zoom or Teams in a browser. Compare the full field on best AI for transcription and best AI for meetings.

10. QuillBot — best for paraphrasing and student writing

Price: Free tier with word limits and two paraphrasing modes. Premium about $19.95 per month or about $99.95 per year, which works out at roughly $8.33 per month. Student about $6.25 per month for verified students. A Teams tier exists; we could not verify its current per-seat price (third-party pricing summaries, checked August 2026) Platforms: Chrome extension, web app, mobile app and a Microsoft Word add-in Key features: Paraphrasing with multiple modes, grammar checking, summarisation, citation generation, synonym control

QuillBot is a narrower Grammarly aimed squarely at academic and student writing, and the verified-student rate at roughly $6.25 per month is the clearest signal of who it is built for.

Why it wins: The annual-versus-monthly gap runs the right way. At about $99.95 a year, Premium works out at roughly $8.33 a month against a $19.95 monthly rate, so committing annually more than halves the cost — the opposite experience to Grammarly’s monthly premium.

Limitations: Paraphrasing tools sit close to a line that matters. Rewriting your own draft is legitimate; rewriting someone else’s work to disguise its origin is not, and rewriting AI output specifically to defeat detection is a different product category with different risks, covered on best AI humanizers and best AI detectors. QuillBot’s free tier is more restricted than Grammarly’s, with word limits on the paraphraser that stop most real work.

Best for: Students and academic writers who need paraphrasing and citation help more than they need generative writing.

11. Merlin AI — most generous free tier, weakest “unlimited” claim

Price: Free plan offering roughly 100 queries per day across supported models with no card required. Pro $19 per month billed annually. Teams roughly $15 per seat per month. Merlin does not publish a monthly Pro rate we could verify (third-party pricing summaries, checked August 2026) Platforms: Chrome and Chromium browsers Models: Multiple frontier models across labs Key features: Sidebar chat, search-grounded answers on any site, Gmail integration, summarisation

Merlin’s pitch is the free tier, and roughly 100 queries a day with no card required is the most generous starting allowance in this guide. For casual use — a few summaries and rewrites a day — many people will never need to pay.

Why it matters: No-card free tiers are rare in this category and they let you evaluate honestly. If 100 queries a day covers you, Merlin is effectively free forever.

Limitations: The paid tier’s “unlimited” claim does not survive contact with independent testing. Reviewers have found the unlimited tier subject to a fair-use cap roughly equivalent to $100 of underlying API usage per month, after which response speed or model access can be throttled. Merlin reports unlimited; independent testing reports a soft cap — we could not verify either figure against a vendor-published limit, and Merlin does not publish one. At $19 per month billed annually it is also the most expensive multi-model sidebar here, costing roughly double Monica for a comparable job.

Best for: Light users who want a capable sidebar without paying anything.

Feature comparison: the full matrix

Pricing comparison: what you will actually pay

Monthly list price in US dollars. Annual figures are the monthly equivalent of an annual commitment. Where a price could not be confirmed on a vendor page it is marked as third-party sourced.

Two patterns are worth naming. First, the annual discount is not uniform: Grammarly charges a 150 per cent premium for monthly billing while Sider charges roughly nothing extra, so the headline price and the price you pay can differ by more than the difference between products. Second, free tiers are capped in two different ways and the difference matters more than the word “free”. Otter caps on volume at 300 minutes a month and Merlin at roughly 100 queries a day, so both stay fully functional within the cap. Scribe caps on capability instead — unlimited guides, but export and redaction sit above the free tier. HARPA’s 10 messages a day is neither; it is a trial.

The security problem: AI extensions were a sustained target in 2026

This section exists because the risk here is not theoretical, not historical, and not rare. Every disclosure below is from 2026.

January: 900,000 downloads, two extensions, full conversation theft. OX Security found two extensions impersonating the legitimate AITOPIA sidebar — ‘Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI’ and ‘AI Sidebar with Deepseek, ChatGPT, Claude and more’ — which together gathered over 900,000 downloads (SecurityWeek, 7 January 2026). They requested consent to collect “anonymous, non-identifiable analytics data” and instead exfiltrated complete ChatGPT and DeepSeek conversations, every URL from every open tab, search queries, and URL parameters containing session tokens and authentication data. OX Security noted that stealing tab URLs leaked internal corporate domains, exposing company infrastructure alongside the conversations.

February: 32 extensions, one codebase, at least 260,000 users. LayerX Security uncovered a campaign it named AiFrame: more than 30 extensions posing as AI assistants, some impersonating Claude, ChatGPT, Gemini and Grok by name, all sharing a codebase and all communicating with infrastructure under a single domain (The Register, 12 February 2026). Two details matter more than the headcount. First, at least one of the extensions carried Google’s Featured badge; LayerX reported that several in the campaign did, and The Register counted 60,000 users on the featured one at the time of publication. Second, the extensions rendered their interface in an iframe loading remote content, which let the operator change the UI and silently add capabilities without shipping a Chrome Web Store update — defeating the review process entirely. Nearly half shared a Gmail integration that read email content, including drafts, straight from the DOM. Google confirmed all 32 had been removed by 17 February 2026.

April: 18 high-risk extensions reported to Google. Unit 42 reported 18 AI-branded extensions to Google, which either removed them or warned their owners (Unit 42, 30 April 2026). Three examples show the range. An extension called Chrome MCP Server advertised “100 per cent local processing — your data never leaves your browser” while accepting more than 30 remote commands over a WebSocket channel, including arbitrary JavaScript execution and HTTPS traffic interception through the Chrome Debugger Protocol. A translation extension with 20,000 users downloaded a proxy auto-config script from its publisher’s server on every startup and applied it browser-wide, a configuration the publisher could change at any time without updating the extension. A job-application assistant exfiltrated the user’s OpenAI, Gemini and Claude API keys from Chrome storage on every request. Unit 42 also found that multiple samples contained AI-generated code, indicating attackers are using models to accelerate malware production.

June: a Perplexity typosquat logging every keystroke. Microsoft’s Defender Security Research Team disclosed on 29 June 2026 that an extension called “Search for perplexity ai” was impersonating Perplexity, using a typosquatted domain, changing the default search engine, and routing search queries and address-bar input through an attacker-controlled server before redirecting users to real results (The Hacker News). Google removed it after responsible disclosure. It worked on both Chrome and Edge.

August: a banned extension came back and shipped a new payload. Netskope Threat Labs reported that ‘AI Sidebar with DeepSeek, ChatGPT, Claude and more’ — removed in January — is active on the Chrome Web Store again and reaching enterprise browsers through Google’s own CRX distribution infrastructure (SecurityWeek, 11 August 2026). It had over 300,000 installs and a 4.6-star rating before the January removal. Version 1.7.2.0 shipped clean between 20 and 31 July 2026, apparently to build a trustworthy update history; version 1.7.3.0 followed with a 21-line addition that opens affiliate links on update and on uninstall. Netskope’s own framing is the important part: the affiliate scheme is low-stakes, but the same channel could carry a far more damaging payload next time. The Chrome Web Store listing falsely shows the developer name as DeepSeek AI.

The structural point. Prompt data is worth more to an attacker than browsing metadata, because people paste API keys, contracts, source code and medical questions into AI tools that they would never type into a search box. Unit 42’s finding is that GenAI-themed extensions invest more heavily in data exfiltration, credential theft and content-security-policy bypass than ordinary extension malware does. The category is targeted because of what flows through it.

How to vet an AI Chrome extension before you install it

Six checks, in the order that catches the most problems earliest.

1. Install from the vendor’s own listing, reached from the vendor’s own website. Never from a search result, a YouTube description or a review site link. Every impersonation campaign above depended on people finding the extension by searching the brand name.
2. Ignore badges and ratings. A Featured badge did not stop LayerX’s campaign, and a 4.6-star rating across 300,000 installs did not stop the extension Netskope caught. Both signals measure popularity at a point in time, not current behaviour.
3. Read the permissions against the stated purpose. A translation tool does not need to intercept every completed HTTP request. A summariser does not need debugger access. Since 1 August 2026 Google’s own policy requires data collection to be strictly necessary to the extension’s disclosed single purpose, which gives you a standard to hold listings against.
4. Check who the publisher actually is. Look for a real company with a real address, a privacy policy naming a data controller, and a domain older than the extension. The extension Netskope analysed named a company registered in February 2024 with no public registrant information, while displaying a different developer name on the store.
5. Watch for ownership changes and quiet updates. Extensions get sold, and new owners ship new code to an installed base that never re-consents. If an extension you have used for a year suddenly asks for new permissions, treat that as a new install decision.
6. For agentic extensions, apply the banking rule. Do not let any extension that can click, type and submit operate in a browser profile signed into your bank, your payroll system or your password manager. Use a separate Chrome profile for agentic work. This applies to the good ones too — a 0.3 per cent attack success rate is not 0 per cent, and Anthropic says so itself.

Best AI Chrome extension for each use case

For most people

Monica at $9.90 per month. It puts multiple frontier models one click from any page for less than half the cost of a single first-party subscription, and the common jobs — summarise, translate, rewrite — do not need the frontier.

For agentic work on systems with no API

Claude in Chrome, from $17 per month on an annual Claude Pro plan billed at $200 up front. It is the only extension here that completes multi-step tasks autonomously and publishes measured attack resistance, and the internal dashboards and vendor portals it was built for are exactly where the time goes.

For anyone already paying for ChatGPT

The ChatGPT Chrome extension, free to install. Your memory, custom instructions and history are already there; a third-party sidebar reselling GPT through an API sees none of that.

For the lowest possible spend

Sider Starter at $4.20 per month billed annually, or Merlin AI’s free tier at roughly 100 queries per day if you can live inside it. Sider is the cheapest paid entry in this guide.

For writing correctly everywhere

Grammarly at $12 per month annually. Fifteen years of working in every text field, and a publisher with a corporate identity, which in this category is a security feature.

For students and academic writing

QuillBot Student at roughly $6.25 per month for verified students, which includes the full Premium feature set. Rewriting your own draft is legitimate; check your institution’s policy before using it on anything assessed.

For research and fact-checking

Perplexity, free, or $20 per month for Pro. It shows sources, and it recorded the lowest citation failure rate of the eight engines in the Tow Center’s March 2025 study at 37 per cent.

For repeatable jobs and monitoring

HARPA AI, from $12 per month billed annually. It is the only tool here where the unit of work is a scheduled job rather than a question, and the only one that can be pointed at your own API keys so no reseller sits between you and the model.

For documenting a process

Scribe, free for unlimited guides shared by link. Budget for Pro Personal at $25 per seat per month annually if you need PDF or Word export, redaction or desktop capture, all of which sit above the free tier.

For meetings in a browser tab

Otter.ai, free for 300 minutes a month or $8.33 per user per month annually for 1,200 minutes. Check consent rules in your jurisdiction before recording.

For maximum privacy

A paid HARPA AI plan running on your own API keys, or no extension at all. Every multi-model sidebar in this guide routes your page content and prompts through a third party. If that is unacceptable, bring your own key — which on HARPA requires a paid plan — or use the built-in Gemini side panel, which at least keeps the data inside a company you have already chosen to trust with Chrome.

For anyone whose Chrome profile is signed into a bank

None of the agentic ones, in that profile. Create a separate Chrome profile for anything that can click and submit on your behalf. This is the one recommendation on this page that applies regardless of which extension you pick.

Frequently asked questions

What is the best AI Chrome extension in 2026?

Claude in Chrome is the best AI Chrome extension in August 2026 for agentic browser work, because it is the only one that completes multi-step tasks autonomously with a safety classifier checking each action, and the only one whose vendor publishes measured prompt-injection attack success rates. It has no free tier and requires a paid Claude plan, starting at Claude Pro at $20 per month or $17 per month billed annually. For most people who just want a capable AI sidebar, Monica at $9.90 per month is the better value because it provides several frontier models for less than half the price of one first-party subscription.

Are AI Chrome extensions safe?

First-party extensions from Anthropic, OpenAI, Google and Perplexity, installed from those companies’ own Chrome Web Store listings, are as safe as any software with page-reading permissions can be. Third-party AI extensions drew sustained, targeted abuse in 2026, with disclosures in January, February, April, June and August. Unit 42’s finding is that AI-themed extensions invest more heavily in data exfiltration and credential theft than ordinary extension malware does, because prompt data is worth more to an attacker than browsing metadata. Google’s Featured badge and a high star rating do not indicate safety: LayerX reported that several extensions in its February 2026 campaign carried the Featured badge, and the extension Netskope caught in August 2026 had a 4.6-star rating across more than 300,000 installs before it was first removed.

Is Gemini a Chrome extension?

No. Gemini in Chrome is built into the Chrome browser and is not installed from the Chrome Web Store. Google shipped the Gemini side panel and auto browse into Chrome on 28 January 2026 for Windows, macOS and Chromebook Plus, and announced the Android version on 12 May 2026. The Gemini side panel is free, but auto browse requires a Google AI Pro or Ultra subscription. Any Chrome Web Store listing describing itself as a Gemini extension is not published by Google, and at least one such listing with 80,000 users was part of a malicious campaign removed in February 2026.

Does Claude have a Chrome extension?

Yes. Claude in Chrome became generally available on 26 August 2026 and is included with every paid Claude plan: Claude Pro at $20 per month or $17 per month billed annually, Max 5x at $100 per month, Max 20x at $200 per month, Team at $25 per seat monthly or $20 annually, and Enterprise at $20 per seat per month billed annually plus usage at API rates. There is no free tier, and Anthropic sells Max as a monthly subscription only. It runs only on Google Chrome on desktop, not on other Chromium browsers such as Edge, Brave or Opera, and not on mobile.

Is there an official ChatGPT Chrome extension?

Yes. OpenAI launched an official ChatGPT Chrome extension in July 2026, at the same time it began retiring the ChatGPT Atlas browser, which stopped working on 9 August 2026. The extension reads the page you are on, understands context across tabs and can start longer-running agent tasks. OpenAI states availability may depend on your plan, region, device, browser and workspace settings, and has not published specific tier requirements. Install it only from OpenAI’s own publisher listing on the Chrome Web Store, because ChatGPT is the most impersonated brand in this category.

What is the best free AI Chrome extension?

Scribe is the best genuinely free AI Chrome extension, because its free tier includes unlimited guides and web capture rather than a trial allowance. For free AI chat on any page, Merlin AI offers roughly 100 queries per day with no card required, which is the most generous chat allowance here. Otter.ai’s free tier gives 300 transcription minutes a month, enough for a light meeting load permanently.

Can an AI Chrome extension read my emails?

Yes, if you grant it access to the page. Nearly half of the 32 extensions in LayerX’s February 2026 campaign shared a Gmail integration that read email content, including drafts and compose-window text, directly from the page structure and sent it to remote servers. Legitimate extensions such as Grammarly and Superhuman Go also read text in Gmail, which is how they function. The distinction is not whether an extension can read your email but whether the publisher is accountable for what it does with it.

How much do AI Chrome extensions cost?

Paid AI Chrome extensions range from $4.20 per month for Sider’s Starter plan on annual billing to $200 per month for Perplexity Max, with most useful tiers landing between $9 and $20 per month. Claude in Chrome has no separate price and is included with any paid Claude plan, the cheapest being Claude Pro at $20 per month or $17 per month billed annually. Several tools charge substantially more for monthly billing: Grammarly is $12 per month annually against $30 monthly, a 150 per cent premium.

What permissions should an AI Chrome extension need?

An AI extension needs permission to read the active tab, and an agentic one also needs permission to interact with pages. It should not need more than its stated purpose requires. Since 1 August 2026, Google’s Chrome Web Store policy has required data collection to be strictly necessary to an extension’s disclosed single purpose, with proactive disclosure of any later change to data handling. Warning signs include a translation or summarisation tool requesting debugger access, listeners on every completed HTTP request, or the ability to change proxy settings.

Can a Chrome extension attack the AI built into my browser?

Yes, and one could. Unit 42 disclosed CVE-2026-0628 on 2 March 2026: an extension holding only the ordinary declarativeNetRequest permission could inject code into Chrome’s Gemini panel and inherit its privileges, reaching the camera and microphone without consent, reading local files and taking screenshots of any HTTPS page, with no user interaction beyond opening Gemini. Palo Alto Networks disclosed it to Google on 23 October 2025 and Google shipped a fix in early January 2026, before publication.

Do AI Chrome extensions work in Edge, Brave and Opera?

Most do, because those browsers are Chromium-based and can install Chrome Web Store extensions. Monica, Sider, Merlin, HARPA AI, Grammarly and QuillBot all run in Chromium browsers generally. Claude in Chrome is the notable exception: Anthropic states it does not run on other Chromium browsers or on mobile. Grammarly publishes a dedicated Edge extension alongside its Chrome one.

What should I do if I installed one of the extensions named in these reports?

Remove it immediately, then rotate anything it could have seen. That means changing passwords for accounts you were signed into, revoking and reissuing any AI API keys stored in the browser, and signing out of active sessions everywhere to invalidate stolen session tokens. Unit 42 found one extension that recreated its tracking identifier from three separate storage layers, including cookies synced across devices on the same Google account, so clearing cookies on one machine is not sufficient — full uninstallation is.

How to choose in August 2026

Start with the question of who you are trusting, not what the tool does. The functional gap between the multi-model sidebars is small and closing; the gap between a first-party extension from a lab you already pay and an anonymous sidebar with 300,000 installs is enormous and getting wider. If you already subscribe to Claude, ChatGPT or Perplexity, use their extension and stop reading. If you do not, Monica at $9.90 per month is the sensible default and Sider at $4.20 is the cheap one.

Then match the specialist to the job. A chat sidebar cannot write your onboarding documentation, transcribe your meeting or watch a page for a price change — Scribe, Otter and HARPA each do one thing that no general assistant does well, and two of the three have free tiers worth having permanently.

Finally, separate your profiles. The single highest-value thing you can do in this category costs nothing: create a second Chrome profile for anything with agentic permissions, and keep it signed out of your bank, your payroll and your password manager. Every disclosure in the security section above turned on an extension seeing something it should never have been in the same browser as.