ChatGPT and Your Browser: What Can AI Actually See, Read and Do?

01 / The story

Can ChatGPT see your browser? The short answer

Not simply because you opened chatgpt.com. A normal ChatGPT conversation receives your messages and the content you provide, such as a pasted passage, an uploaded screenshot or an attached file. Web search lets it retrieve information online. Neither fact alone means it can inspect every tab, your private inbox or the contents of another application.

The answer changes when you deliberately connect a browser. OpenAI now documents a desktop browser extension, a built-in desktop browser and a separate cloud browser for ChatGPT Work. These can read pages or take steps within their supported workflows and permissions. A browser connection is therefore a bigger decision than asking an ordinary chat to explain a public article.

We checked the linked official documentation on October 16, 2026. This guide separates those modes rather than treating every feature called browsing as the same product. The numbers in brackets refer to the linked sources after the FAQs. Qlauson has not performed a hands-on privacy audit or tested every account, browser and region.

02 / The story

What changed—and is ChatGPT Atlas still current?

Some reports and older tutorials discuss ChatGPT Atlas, OpenAI’s dedicated browser. The current official help page says Atlas has been retired and no longer receives updates. It also says bookmarks, tabs, browsing history and signed-in sessions do not transfer automatically. That makes an old Atlas demonstration a poor guide to what you should install today. [1]

The current browser-extension guide describes working in Chrome, Microsoft Edge, Brave, Opera or Vivaldi from the ChatGPT desktop app. All five support tab mentions and browser control in the documented desktop workflow. Chrome, Edge, Brave and Vivaldi also support side chat; Opera does not. Availability can depend on rollout and workspace settings. [2]

OpenAI separately documents a built-in browser in the ChatGPT desktop app on macOS and Windows, plus a cloud browser that runs on a separate remote computer. These are documented features, not hypothetical products. We did not establish one exact public launch date for the present extension and all its supported browsers, nor verify a new live presentation near today. Do not turn the update date of a help page into a launch date. [3, 4]

03 / The story

Four ways to use AI with a webpage

Start by identifying where the information comes from. Shared content is material you send. Search retrieves online sources. A connected local browser uses a browser profile on your computer. Cloud browsing uses a remote browser. That last distinction matters: signing into Chrome does not automatically sign you into a separate cloud session.

This table is Qlauson’s explanation of the official documents, not an OpenAI product ranking. Different tools can be combined during a task, so check the active mode and requested permission rather than relying on the word ChatGPT. [2–5]

04 / The story

Can it read open tabs, selected text and videos?

In the supported extension workflow, you can mention an open tab to give ChatGPT that page as context. In browsers with side chat, you can also highlight text or use Ask ChatGPT from the page’s right-click menu. The guide says ChatGPT can use context from open tabs when a task needs it. That is more than manual copying, but it is not evidence of unrestricted, continuous surveillance of everything you browse. [2]

The permission boundaries deserve careful attention. OpenAI says it asks before interacting with each new website by default. You can allow a site once, save approval for that site, decline, or allow all sites. Choosing the last option removes future website confirmations and is explicitly labeled elevated risk. A saved approval changes what happens next time; do not assume every future interaction will produce a fresh warning. [2]

For YouTube, the extension documentation describes using a timestamped transcript when captions are available. Summarizing captions is not the same as reliably interpreting every visual event, tone or missing subtitle. A screenshot similarly captures one view, not an entire browsing session. Check the original passage, image or video before treating a summary as evidence. [2]

05 / The story

How to try the official extension without over-sharing

Use the setup path in OpenAI’s guide rather than an advertisement for an extension with a familiar name. Update the ChatGPT desktop app, open Settings and Computer Use, choose a supported browser and follow its installation prompts. The app links to the extension store and may require a plugin. After installation, check that the browser shows Manage and that you are using the profile where it was installed. [2]

Start with a public page and a narrow request: explain this paragraph, extract the published specifications, or compare these two permitted tabs. Mention the relevant tab rather than opening unrelated private accounts for convenience. Review the requested host and choose limited access when that meets the task.

OpenAI’s listed installation permissions are broad. They can include page debugging, reading and changing website data, history, bookmarks, downloads and communication with a cooperating desktop application. Those permissions describe technical capability. The guide also describes separate task confirmations and site controls; a permission list alone does not establish which data is used on each task. Conversely, an in-app confirmation is not a reason to ignore broad installation privileges. [2]

• Use the official installation flow and review the publisher and permissions.
• Choose a low-risk public page for the first trial.
• Check the browser profile and active website account.
• Prefer one-time approval to unnecessary all-site access.
• Review and remove saved website permissions when a task is finished.

06 / The story

What can it actually do—not just read?

A browsing agent can go beyond summarizing. OpenAI’s cloud-browser guide lists reading pages, clicking buttons, entering form information and carrying out steps on supported public or signed-in websites. Its examples include checking travel options, finding appointments, comparing utility plans and updating records. Those are documented use cases, not a promise that every airline, booking site or company application will work. [4]

Reading and changing are different permissions in practice. Asking for a comparison should not silently become agreeing to a contract. The cloud-browser guide says consequential actions—such as payments, bookings or other hard-to-reverse commitments—are designed to require confirmation in chat. Website approval is separate from approval for an important action. Review the exact item, recipient, date and amount before accepting. [4]

If a site blocks automated access, the task may fail even when it works in your normal browser. Captchas, changing layouts, unsupported controls and account restrictions are reasons to take over or finish manually. Do not seek a way around security checks, paywalls or access rules. Having an account is not a blanket right to automate every use of it.

For a useful small experiment, ask for a draft rather than an irreversible outcome: prepare a shortlist, summarize two product pages, or fill a non-sensitive form for review without submitting. These are suggested trials, not results from Qlauson testing. Check the final page or saved record, not merely the assistant’s statement that it succeeded.

07 / The story

Passwords, private accounts and browser history

A signed-in browser is powerful because it can reach information public search cannot. An extension may work on your existing authenticated pages, including email or internal tools. That does not mean the model must know your password to see information after login. Your signed-in session is itself a route to private records and possible account changes. [2]

The built-in desktop browser uses its own state rather than your Chrome profile. OpenAI instructs users to enter credentials in the browser, never in chat. For cloud browsing, its secure sign-in form passes credentials directly to the remote browser; OpenAI says those credentials are not visible to the model and are not stored as sign-in credentials. The signed-in session can persist until it expires. These are product statements, not a guarantee that every page or credential workflow is risk-free. [3, 4]

Browser history is a separate sensitive source. It can reveal search terms, internal addresses and activity from signed-in devices. The extension guide says history access is scoped to a request and has no always-allow option. Relevant entries can still become part of the task context. Avoid approving history access when the task only needs one page. [2]

For financial, healthcare, legal or confidential work, first decide whether an AI service should receive the material at all. Workplace permission, contracts and applicable data-protection rules still matter. Remove unnecessary personal details and use an approved environment. This guide is educational, not legal, medical, financial or security advice, and it cannot certify a workflow as GDPR-compliant.

08 / The story

Where does browser data go? Training is not the only question

OpenAI’s extension guide says it does not store a separate complete record of browser actions from the extension. It does store browser activity when that activity becomes ChatGPT context: page text, screenshots, tool calls, summaries, messages or other chat content. This is an important distinction. Not recording every browser action does not mean that the pages used in a task never leave your computer. [2]

In ChatGPT’s Data controls, turning off Improve the model for everyone means new conversations are not used to train OpenAI models. They can still appear in chat history. Training choice, retention, memory and access are separate questions. The current guide also describes a separate Codex Include environments setting; changing the general training preference does not change that setting. Check the controls relevant to the workflow you actually use. [6]

Temporary Chat is not an invisibility mode. Current documentation says a chat remains outside history and is not used to improve models while temporary, but a copy may be kept for up to 30 days for safety. You can choose personalized or unpersonalized before starting. Personalized temporary chats can use existing memories, instructions and plugins, but do not create or update memories while temporary. Saving the chat converts it to a regular chat with the account’s applicable settings. [7]

Search has its own data flow too. OpenAI says it may send rewritten queries and general location to search partners, but not the IP address itself or ChatGPT account information for running the search. Memory can influence query rewriting. Avoid placing confidential material in a search request just because you did not install an extension. [5]

09 / The story

Prompt injection: when a page tries to give the AI orders

Prompt injection means untrusted content tries to redirect an AI away from your real task. A page might contain instructions that look like part of a report but tell an assistant to copy private information elsewhere or ignore the user. The risk becomes more serious when the same assistant can read private records and take actions.

OpenAI’s December 22, 2025 security article describes prompt injection as a long-term challenge and explains ongoing defenses for Atlas’s browser agent. We use that historical article to explain the risk class, not to claim Atlas is still available or that its defenses prove the present extension is secure. The current extension and browser guides also tell users to treat page content as untrusted context. [2, 3, 9]

Keep the task narrow, limit sites and check the proposed destination before sharing anything. Stop if the assistant opens the wrong account, changes its goal or asks to move unexpected records. Human review helps, but it is not proof that every malicious instruction has been caught. Qlauson’s AI Agent Security guide explains these limits in more detail; it is linked in Further reading.

010 / The story

Availability, pricing and a fair comparison

ChatGPT web search is documented on Free, Go, Plus, Pro, Business, Enterprise and Edu, and for signed-out users, subject to limits. The built-in desktop browser is documented for macOS and Windows. Cloud browser is available in Work on supported paid plans and regions, excluding Free and Go, with rollout and workspace restrictions. Do not infer cloud-browser eligibility simply because a free account offers some desktop Work access. [3–5]

The official pricing page checked today displays Free at $0, Go at $8 per month, Plus at $20 per month and Pro from $100 per month across usage tiers. These are displayed dollar-plan prices, not a guaranteed total in every country or store. Taxes, currency, billing route and future changes may affect what you pay. We found no separately stated fixed extension price in the checked extension guide and no complete region-by-region entitlement table there; verify the feature in your account before subscribing for it. [8]

Google’s official Gemini in Chrome guide offers a useful alternative comparison: it says Gemini uses the current tab and allows up to ten open tabs to be shared on a computer. Access depends on eligibility, region, account and Chrome setup; it is not available in Incognito. That is a documented context-sharing workflow, not evidence that either assistant is faster or more private. Compare the actual page access and required approvals, not just the brand. [10]

A conventional browser’s Find function can locate exact text without an AI summary. Manual copying gives you a more deliberate boundary, although anything you send is still processed by its recipient. We have not verified equivalent prices or run a side-by-side test of competing browser assistants, so this is a capability comparison, not a recommendation based on untested speed or security claims.

The practical choice is not which assistant sounds most human. It is which method completes your task with the least necessary access and a result you can check. An AI summary may help a student understand dense text; it cannot replace reading the source for a quotation. Product comparison can help a shopper organize choices; current checkout terms still decide the purchase.

011 / The story

Our verdict: useful access, not an all-seeing browser

AI browsing is useful when the task is specific and the evidence is visible. Researchers can collect public sources, students can ask for simpler explanations, and professionals can prepare drafts in approved systems. Delegating high-impact decisions or letting an assistant roam through unrelated private accounts is a different risk category.

The key question is what you connected, what it can use and what you approved—not whether the tab says ChatGPT. Choose ordinary search or a small shared passage when that is enough. Use browser control only when its extra reach is needed, and inspect the final result. No documented capability makes the assistant error-free.

This article reflects official documentation checked today, not a promise of any unannounced 2027 release, lower price or broader access. The original artwork is a conceptual still life, not a screenshot or evidence of an unreleased interface. Product names and trademarks belong to their owners; Qlauson is not affiliated with or endorsed by OpenAI.