Google adds security controls for AI agents in Chrome

Google has outlined new security measures for AI agents in Chrome Enterprise, aimed at protecting data when automated tools act on behalf of employees in the browser.

The move reflects a broader shift in workplace software as AI agents increasingly carry out multi-step tasks across web applications rather than simply generating text. Google is positioning the browser as the main environment for that work, arguing that it already contains the user identity, access settings and live context of an employee's session.

That matters because many new agent-led workflows move between software-as-a-service platforms, internal documents and public websites. In examples cited by Google, a recruiting agent could scan public professional profiles and create candidate files in a web-based applicant tracking system, while finance and operations teams could use an agent to sign into billing portals and collect invoice documents.

Those activities raise questions for information security teams because an automated agent may handle the same sensitive commercial, financial and personal data as a human employee. Organisations need to ensure that the same controls applied to staff also apply to software agents acting under their authority, Google said.

Browser controls

Chrome Enterprise Premium is bringing data loss prevention tools directly into browser-based agent workflows, with controls that inspect data flows in real time and can block unauthorised transfers of sensitive intellectual property, personally identifiable information or financial data to public large language models.

Administrators can also use extension controls to manage permissions and identify risk signals linked to scraping page content. In practice, that means a company can try to stop agents or connected software from extracting data from web pages without approval.

Another part of the approach extends context-aware access controls from the employee to the agent. If a worker is not authorised to view or export specific information, any AI agent acting for that worker should face the same restriction, according to Google.

Layered model

The security design described by Google uses several layers intended to limit what an agent can do and make its actions visible to the user. One element is a system called the User Alignment Critic, which Google said was partly inspired by research from Google DeepMind.

The model acts as a gatekeeper for Chrome auto browse by checking the metadata of a proposed action against the user's original goal. If an attack tries to redirect the agent away from that goal, the system is designed to block the action, Google said.

Another layer builds on Chrome's long-standing site isolation architecture. Google said it is restricting an agent's activity to website origins directly relevant to the task, with the aim of preventing a compromised agent from moving across unrelated logged-in services.

Users will also be able to see how an agent reached a decision through a work log in the browser tab. That record is designed to let an employee intervene during the task rather than only reviewing actions after the fact.

Chrome will also require direct human approval at critical moments. Auto browse is designed to stop before actions such as finalising a contract, submitting a financial transaction or sending a mass email, so the user must explicitly approve the step, Google said.

Background pages visited by agents will be marked in Chrome History as agent actions, giving workers and administrators another audit trail of what the software did during a browsing session.

Visibility push

Google linked the latest measures to a wider effort to give corporate technology teams more insight into how browser-based agents interact with company data. It pointed to earlier work on extension visibility, intended to show how software agents access and handle sensitive information in the browser.

Google is also testing the new protections with automated machine-learning red-teaming systems that simulate attacks against Chrome's agentic features. In addition, it has expanded its Vulnerability Rewards Program to cover those functions, with payments of up to USD $20,000 for verified breaches of agent security boundaries.

The broader commercial aim is clear: if more day-to-day office work is handed to AI agents, the browser becomes a more strategic control point for enterprise security vendors. By embedding governance and oversight in Chrome itself, Google is seeking to make the browser the place where companies manage the risks of automated web activity as well as the work itself.

Google said it is extending core browser isolation principles, adding visibility controls and applying data loss prevention to agentic workflows, while requiring human approval before high-stakes actions are completed.