Browser extension

Until an admin turns checks on, the extension does exactly what 0.2 did: it reports a visit to an AI app it knows, and nothing else. The setting is Estate → Shadow AI → What the extension checks (owners and admins), saved through the change log like every organization setting, with an Undo. The extension fetches it with its ingest key (POST /api/shadow-ai/extension/policy) at most every ten minutes; a browser that can't reach Intertrace keeps the last setting it saw, and one that never saw any reports visits only.

Content scripts run only on the AI apps the manifest lists (ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, Poe, Character.AI, Grok, Hugging Face Chat, Le Chat, OpenRouter), matched by host. Before a message is sent (Enter in the text box, a Send button or the form's submit) and on every paste, the extension reads the text the person wrote and checks it in the browser, with no network: credential shapes (OpenAI, Anthropic, AWS, Stripe, GitHub and Slack keys, signed tokens, private keys) and card numbers (a card network's prefix and length plus the Luhn check). These are the same rules the platform uses for its own redaction. A value that is plainly a placeholder (sk-your-api-key-here, AWS's documented example key, a run of the same letter) is not a credential.

By default, once on: a credential stops the send with a banner saying what was found and why; a card number is hidden in place (its last four digits kept) and the message goes on; a file is reported. Each can be set to stop, or to send and report.

With Also send each message to Intertrace's screen on, the extension sends the message text to the screening API (/v1/security/screen, see the screening API guide) and applies its answer: BLOCK stops the send with a banner, MASK replaces the text in the box and sends it (if the box doesn't take the change, the send is stopped instead), FLAG sends it and reports it. The screen sees the text; Intertrace stores only the decision, as for any screened prompt. It decides with the data and attack settings of the agent "Browser extension (Shadow AI)", created on first use. The extension gets an eight-hour runtime key for it from its ingest key (never longer than your key rotation policy), kept in the extension's service worker and never in the page; turning screening off revokes them. When the screen can't be reached (timeout four seconds), the message is sent and reported, or, if you choose, stopped.

Each report is a signed event on POST /api/shadow-ai/events with an inspection object: what kind of input it was (message, paste, upload), what happened (sent, reported, flagged, hidden, stopped, sent unchecked), the classes found (card, credential:openai_key, …) and their counts, the text's length, and the screen's decision with its reason codes. Never the text. The server refuses a report carrying any other field. Events from 0.2 have no inspection and read as before.

Uploads through a file picker, a drop or a pasted file are reported with the file name's extension and the size, and whether policy stopped them. Version 0.3 does not read a file's content: a document full of card numbers is not found by the extension. Stop uploads to AI apps, or rely on your endpoint DLP, if that matters.

1. 1

   Not a boundary

   A person who disables the extension, uses another browser or retypes a key with spaces gets past it. Push it with device management and block the apps you don't allow at your proxy or DNS.

2. 2

   Generic text boxes

   An app that sends from something other than a text box, Enter, a Send button or a form submit (voice, a custom shortcut) is not checked.

3. 3

   Signed-in account

   0.3 does not read which account the person is signed in to, so its events' account class stays unknown.