A side panel beside the tab
A Manifest V3 side panel opens from the toolbar icon or Command+Shift+A and sits next to the page rather than over it.
Loading…
Loading…
AGI in Chrome · Coming soon
The panel reads page text when you ask for it, and only on an origin you put on the allowlist. Every answer it gives comes back from AGI Managed Cloud. Computer use goes further than that: it attaches Chrome’s own debugger to the tab and posts the conversation, screenshots included, under your account token.
Destinations
The panel talks to AGI Managed Cloud. The bridge, when you pair it, talks to your own machine and nowhere else. Computer use opens a third road, and it is by far the loudest of the three.
Press send and your message, the conversation so far, and any page text you attached go to AGI Managed Cloud. The extension holds no provider key and offers no second chat route, so this is the only road for an answer. An origin you have not approved contributes no page text to it.
Pair AGI Desktop once, by reading a code off its window and typing it into the panel, and the status pill turns from “Desktop optional” into “Desktop tools”. The capture shortcut has this destination and no other, so on an unpaired browser it captures nothing at all rather than capturing and discarding.
Browser control needs Managed Cloud sign-in and a separate per-origin approval whose own text says it grants full DevTools-Protocol control of your signed-in session there. Every step of the run posts the conversation and the screenshots it has taken to the Managed Cloud gateway under your account token.
A computer-use step calls the Managed Cloud gateway directly from the extension, and it carries the conversation together with every screenshot the run has taken of your tab. Those images are not redacted and cannot be. Whatever your signed-in page was showing is inside the picture. Approve an origin for browser control only if you would hand us that session. The gates, the allowlist, and what remains after both are written out at agent permissions.
Capabilities
Everything below is already built into the extension, scoped to the pages and the actions you approve.
A Manifest V3 side panel opens from the toolbar icon or Command+Shift+A and sits next to the page rather than over it.
A content script loads on every http and https page so the panel can read the one you point it at. It reads when you ask, and it sends nothing from an origin that is missing from your allowlist.
Pairing is a two-step handshake: Desktop parks a code and shows it on screen, you type it into the panel, and Desktop hands back a token. Reaching the loopback port is not enough on its own.
A run attaches the Chrome DevTools Protocol debugger to one approved origin for one bounded action and detaches afterwards, with Chrome’s debugging banner up the whole time. Each step sends the conversation and its screenshots to the Managed Cloud gateway.
Browser control asks Chrome for that single origin. Take the site off the list, or revoke the host permission at chrome://extensions, and the control goes with it. Approved origins ask before each action until you say otherwise.
Text read during a run is scanned for the phrases that try to turn an agent around: ignore previous instructions, send this to, your API key, one-time code — and a match reaches the model wrapped in a security warning.
Recording writes down the elements you touched; typed values stay out until you switch value capture on, and the on-page badge names the mode either way. Password fields are dropped even then, and a recording is bound to the origin where it started, so it refuses to replay anywhere else.
Up to fifty saved tasks fire through Chrome’s own alarms and live in extension storage. A task carrying a prompt belongs to the Managed Cloud account that made it and stays invisible to any other.
The ledger
Each row describes what the extension code already does today, including the rows we would rather not have to write.
| Manifest | Chrome MV3 · side panel, service worker, and a content script on http and https pages |
| Chat | AGI Managed Cloud, every message. The extension ships no local chat runtime. |
| Page text | Leaves only from origins on your allowlist. An unapproved origin contributes nothing. |
| Desktop bridge | Optional. Loopback hosts only, default port 8787, paired by typing a code shown in the Desktop window. |
| Bridge integrity | Every native message is HMAC-SHA-256 signed over its id, timestamp and body with a per-session secret. |
| Keys in Chrome | None, and none accepted. Computer use runs on AGI’s server-side provider key rather than one of yours. |
| Computer-use egress | The whole conversation and every screenshot POST to the Managed Cloud gateway under your account token. Screenshots are not redacted and cannot be. |
| Chat sync | Managed Cloud chats are copied to your AGI account by default so they appear on web and mobile. One switch in options keeps them in this browser. |
| Cookies | A run can set a cookie on a site you are working in and never reads one. Banking, health, cloud-console, identity and mail domains are refused outright. |
| Prompt injection | Page text read during a run is pattern-scanned and reaches the model with a security warning when it matches. |
Public launch: date to be announced
The extension is a browser client. Local models, encrypted provider keys, and the tools the panel borrows over the bridge all live in the desktop app, so that is where to start.