A security checklist for AI tools that read and act in your browser

What should a security check of a browser AI tool cover?

Five questions, and every check below answers one of them: where does what it reads go, what may it reach, what may it do without asking you, how does it treat text that gives it orders, and what does it record. A tool that only answers questions about a page raises the first two; a tool that clicks, types and pays in your signed-in accounts raises all five.

The list fits any browser AI tool, an extension, an AI browser or an agent app. After each check is how Minda Super Intelligence answers it, with the setting’s name, so you can hold another tool to the same list.

Where does what it reads go? (checks 1 to 3)

Check 1: who receives each request. A browser AI tool sends your question, and usually the page you are on, to a model somewhere; the answer should name the provider, not just "our AI". In Minda you pick it per chat in the model menu: Minda’s hosted models, which pass through Minda’s server (it keeps each request’s model, credits and time, never the words), your own OpenAI, Claude, Gemini, DeepSeek, OpenRouter or Qwen key, or a model in Ollama on your computer.

Check 2: one switch that keeps it all at home. Keep SI on this computer (Settings → AI → Privacy) refuses every cloud provider, Minda’s hosted models, cloud speech and the agent’s search, translation, connector and picture tools before anything is sent; chat then runs on Ollama. AI on a local LLM walks through it.

Check 3: a record you can read. The AI activity log (Settings → AI → Privacy → AI activity) lists every model request: the provider, the model, the host it went to, how many characters and pictures, and which pages and attachments by title. The words are never kept, and a temporary chat is never saved at all.

What may it reach? (checks 4 to 6)

Check 4: sites it may never touch. In Settings → AI agent → Access, block a site and the agent never reads, opens or acts on it, its subdomains included, and its page is not even shared as context. Your bank, your password manager and your payroll are the usual first rows; the list holds up to 200 site rules.

Check 5: only the tools the job needs. Seven switches each take a family of tools away from every chat, task and schedule: act on pages, use memory, search history and bookmarks, use connected apps, make pictures and videos, ask other agents and search the web. Below them, each single function has its own switch.

Check 6: the accounts in reach. An agent in your browser works in your sign-ins. Minda keeps each account in its own workspace, with its own cookies, so a job can run where only the sign-ins it needs are. With Auto on, a chat may use any of your workspaces; with Auto off, only the one on screen and the ones your own words name. A private window keeps nothing once it closes.

What may it do without asking you? (checks 7 and 8)

Find the default first. In Minda, Auto in the chat box’s Modes menu is on by default: the agent finishes tasks without its OK cards, may use the sign-ins of any of your workspaces, and, if you turned on computer control, works this computer at Full control. It still stops for a password, a code or a CAPTCHA, and for a payment while Ask before paying is on. Turn Auto off and Minda asks before it acts.

• Check 7: payments. Ask before paying, on by default: a press that pays, buys, books or places an order, and card or bank details typed, wait for your OK in every run, Auto or not.
• Check 8: steps you cannot take back. Careful, off by default and in the same Modes menu, keeps Auto on but makes a step that sends, posts, submits, deletes, uploads a file, types a password, code or card number, or gives access wait for your OK, in chats, tasks and schedules. A paid team can require it for everyone.
• For my review. Write "for my review" or "draft" and the finishing press (Submit, Send, Post, Publish, Approve, Pay) waits for you in tasks and schedules, and in a chat while Auto is off or Careful is on.

How does it treat text that gives it orders? (check 9)

Check 9: page text is data. Every tool that reads pages meets prompt injection: text on a page, in a mail or in a file that tries to give the AI orders. Ask how the tool keeps your words apart from the page’s. In Minda, page text, files and tool results reach the SI agent inside a fence that marks them as untrusted, with a standing rule to read them as data, never as instructions. When fenced text speaks to the AI, the agent does none of it, carries on with your task and says in one line what the page tried.

The fence is a rule the model follows, not a wall, which is why checks 7 and 8 matter: they wait for you whatever the model was told. What is prompt injection has the examples and the known gaps.

Can you see what it did, and stop it? (check 10)

• The action log (Settings → AI agent → Activity) keeps the newest 500 steps: the tool, the site, done, failed or declined, whether a chat or a background run did it, and the saved agent’s name; never page text or typed text.
• Stop ends a run at any time. In a chat the agent works in tabs you do not see, so your own tab stays in front; open its tab to watch.
• Turn it all off. With Built-in AI off (Settings → AI → Privacy), every built-in AI request is refused: a reply or task in flight stops, AI schedules pause, and nothing reaches a model until you turn it back on. Websites’ own AI and a coding agent you connect are outside it.

What else belongs on the list?

• Keys and secrets. AI keys and connector secrets belong in the operating system’s keystore, out of the model’s sight. Minda keeps them encrypted by the operating system, never shows a connector’s address or token to the model, and never syncs API keys.
• Outside tools. An MCP server you add runs its tools without a prompt, and its answer goes to the model like a page. Add only servers you trust.
• Shared skills. A community skill you install starts off and marked for review until you read it.
• The account itself. Turn on two-step sign-in for your Minda account, with an authenticator app, and give sync your own passphrase if you want it end to end: by default Minda’s server holds the sync key and can read what syncs.
• A coding agent’s bridge. Off by default. When on, it listens on 127.0.0.1 only, with a token, refuses requests from web pages, and asks before each click unless you allow its own tabs.

How does a team hold everyone to the list?

With policies, set on each computer through Windows Group Policy or Intune, or a policies.json on Windows, macOS and Linux, or by the admins of a team with paid seats; a policy set on the computer wins. The ones that map to the checklist:

• AiLocalOnly forces Keep SI on this computer, and AiProvidersAllowed names the providers that may be used (checks 1 and 2).
• AiAgentActionsEnabled off stops the agent clicking, typing or pressing keys on pages at all (check 5).
• AiAgentCarefulMode puts every member’s agent in Careful, and members cannot turn it off (check 8).
• AiChatHistoryEnabled off makes every chat temporary; ConnectorsEnabled, McpServersEnabled and DeveloperAutomationEnabled turn off connectors, MCP integrations and the coding-agent bridge.