AI agents in your browser tabs: what to check before they click send

Last week, OpenAI updated its ChatGPT extension for Chrome. In a new Work mode, ChatGPT can control the tabs you already have open: it can send messages, fill out forms, download files and group tabs. That puts an AI agent inside the place where much office work already happens, on sites where you are often signed in. It also moves the hard question from "can it do this?" to "how do we know it did it right?"

What changed

The extension now has two modes. In Chat, ChatGPT reads your open tabs and answers questions using what is on them. In Work, it can act on those tabs. OpenAI's example tasks include filling in an event registration form from an event brief, adding vendors from open tabs to a comparison sheet, and drafting an email to the best contractor after comparing several.

There are some controls. By default, ChatGPT asks before it interacts with each new website. You can allow a site once, allow it always, allow all sites, or say no. Access to your browsing history needs a separate request. Coverage of the launch also notes that the agent can work on sites where you are already logged in, and advises people to watch what is being done on their behalf.

Permission is not proof

These controls answer one question: where is the agent allowed to go? They do not answer the question that matters once it gets there: did it do the task correctly? An agent with permission to use your email can still send the wrong attachment, to the right person, in a polite and fluent message. A form can be filled in completely and still carry last year's address.

Browser work has a feature that makes this sharper. The agent acts with your sign-ins, so whatever it does looks like you did it. And pages can hold text the agent reads but you never notice, including instructions written to steer it. That is why reading a page and acting on a page are such different levels of trust.

An allowed site tells you where the agent may act. Only a check of the result tells you whether it acted well.

Find the step that cannot be undone

One of OpenAI's own sample tasks asks ChatGPT to fill in a form and stop before submitting. That small phrase holds a useful rule. Most browser tasks have a point after which a mistake is hard to take back: sending, submitting, paying, deleting, sharing a file. Before that point, an error costs a few seconds to fix. After it, someone else has the wrong information.

A sensible way to start is to map those points for each task your team hands to an agent:

• Let the agent gather, compare and draft freely, since reading and drafting are easy to check.
• Require a person to review before anything is sent, submitted or paid.
• Keep a record of what the agent did, on which site, and who approved it.
• Count how often the reviewer changes something, and what kind of change it was.

Teams often skip that last item. Without it, the review step never ends, because nobody can show it is safe to remove.

Autonomy earned task by task

The real choice is not all or nothing. It is about which tasks an agent has shown it can do well enough to run without a check. That evidence has to come from the actual work. A general benchmark says little about whether an agent fills in your supplier forms correctly, or knows that one field in your expense tool must match the receipt exactly.

The people best placed to judge are the ones who do the work today. They know which mistakes are harmless and which ones cost a client, a payment or a deadline. When their reviews are recorded and compared, they turn into a measure: this task, this error rate, over this many runs. A task with a clean record can be given more freedom. A task where reviewers keep catching problems stays behind a check, and those problems become test cases for the next version.

What this means in practice

If your team starts using browser agents, begin with read and draft, and keep a person at every step that sends or submits. Write down what a correct result looks like for each task. Track what reviewers catch. Widen the agent's freedom one task at a time, when the record supports it. At SoReliable, we think this is the core of reliable AI at work: capability gets an agent into your tabs, but measured expert judgment is what shows when it can be trusted there.