Risk Scoring
Every extension gets a 0-100 score based on observed runtime behaviour, rather than permission counting or signature matching.
An LLM agent reads the deobfuscated extension source and produces specific, falsifiable claims about what the extension does - not a generic risk category, but a concrete hypothesis: this code path exfiltrates form data, this endpoint receives credentials, this payload is assembled at runtime.
A second LLM agent runs the extension in a live instrumented sandbox with those claims in hand. It drives the extension specifically to test each hypothesis - visiting pages, triggering interactions, watching network traffic. It is trying to prove the static agent right, not just passively observing.
All evidence from the sandbox run is collected alongside the LLM-generated reasoning from both agents - network captures, DOM observations, decoded payloads, and the chain of inference that led to each claim.
Claims are checked against the collected evidence. Verification is mixed: LLM and human. High-severity findings get a human researcher before they reach your dashboard. Low-confidence findings are flagged separately so you can judge them yourself.
Case: Stylish - 2M users
What the profile showed
What the pipeline found
Every URL transmitted through five layers of obfuscation to a data broker on every page load. No user action required.
AI chat content scraped and exfiltrated from ChatGPT, Claude, Character AI, and others.
None of the signals above told you what the extension was doing. The badges are not a security control.
“They build a payload, then put it through URL encoding, double base64, JSON stringify and base64 again, a columnar transposition cipher, AES-256-CBC with a symmetric key hardcoded in the extension source, then base64 one final time.”
Stylish Is Back, Back Again
2M users. Featured and Verified badge. Exfiltrating every URL you visit.
“Any site with the same Country Code eTLD could exfiltrate usernames, passwords, URLs and TOTP codes from any other login on the same eTLD. No user interaction. The manifest was totally fine.”
MultiPassword - CVSS 8.3
1M+ users. Found and disclosed by the AIBP pipeline.
“Their median risk score for CRITICAL extensions (46) is actually lower than for CLEAN ones (49). The scores showed no meaningful correlation with actual risk across our sample of 2,534 extensions.”
Spin AI vs Am I Being Pwned
What happens when you score by permissions alone.
Configurable per policy and device group
You configure the score levels at which extensions trigger a warning, alert, or block - per policy, per device group. A score of 80+ might mean an immediate block via MDM; a score of 50 might mean a 48-hour review window. Thresholds are yours to set.
Example thresholds
See risk scores for your current extensions.
Scan your fleet in under 48 hours.
