The browser tab where you ask ChatGPT to explain a stack trace is a different trust boundary from the terminal where Claude Code runs — and most teams only instrument the second one. Beam Sentinel is Beam's Manifest V3 extension that checks prompt text on major AI chat sites immediately before it is sent, using the same local heuristic rule set as the sentinel-collector scanner, with high- and critical-severity matches paused for an explicit Allow once. This post is the threat model for that surface: what can go wrong in a chat UI, what the extension actually inspects, and what remains your problem after you click send.
If you want breach statistics and survey numbers, see how much sensitive data people share with AI chatbots. If you want GPU hangs from untrusted pages during agent-driven browsing, see the WebGPU Deathray. Neither replaces this page — they cover adjacent risks, not the paste-and-send path Sentinel targets.
TL;DR
| Question | Answer |
|---|---|
| What is the core risk in browser AI chats? | You paste production context — configs, traces, customer fields — into a composer; the request leaves your browser to a provider you may not govern |
| Does Sentinel read my browsing history? | No — content scripts run only on the six assistant domains listed in the README; checks use page composer text at submit time |
| What happens on a high/critical match? | Send is paused until Allow once; live tokens and private keys are auto-redacted in the message first |
| What happens on medium matches? | Short warning; send continues unless you stop |
| Does data leave my machine for the check? | No authentication and no network request for checks, per chrome-apps/beam-sentinel/README.md |
| What is stored locally? | Latest 100 redacted decisions in chrome.storage.local; raw editor contents are not stored |
| Does this replace DLP or IT policy? | No — it is a personal, local guardrail on supported chat UIs, not fleet enforcement |
The chat-UI threat model (not the coding-agent model)
Coding-agent risk is usually framed around tool use: a skill file that exfiltrates, an MCP server that rug-pulls, a rm -rf the model argued for. Beam's local collector records those side effects — commands, paths, endpoints — from agents running on your machine.
Browser chat risk is mostly human-driven disclosure:
- Paste amplification. A stack trace,
.envexcerpt, ticket export, or SQL fragment goes into the composer in one gesture. The model did not "hack" anything; you supplied the secret. - Account boundary. Many sessions run on personal, free tiers outside employer DLP, even when the pasted material is work product — the pattern the 2026 sensitive-data roundup documents with telemetry, not hypotheticals.
- Dual use of the same machine. The same developer who runs
bun run --cwd apps/sentinel-collector devfor Claude Code hooks still keeps ChatGPT open for quick questions. Monitoring one tab does not monitor the other unless you add a surface-specific control. - Prompt injection in chat (distinct from paste leakage). A malicious snippet embedded in a page you ask the model to summarize can steer the conversation — overlapping with MCP and skill injection conceptually, but arriving through chat content rather than a installed skill file. Sentinel's instruction override rule flags some override phrasing in what you are about to send; it does not scan the provider's reply stream or third-party plugins.
- After send. Retention, training use, subprocessors, and breach surface at the vendor are policy and architecture questions. A pre-send check only affects the moment before the HTTP request leaves the page.
None of that is a WebGPU shader locking the GPU (Deathray). None of it is fixed by quoting Cyberhaven percentages alone. The actionable frame is: treat the chat composer like outbound email — once it leaves, you do not get a local undo.
What Beam Sentinel checks (grounded in the repo)
From chrome-apps/beam-sentinel/README.md:
A minimal Manifest V3 extension that checks prompts, code, and commands immediately before they are sent from major AI assistant pages. It uses the same 12 heuristic patterns as
apps/sentinel-collector.
Behavior, quoted and paraphrased from that README and chrome-apps/beam-sentinel/src/rules.js:
- High and critical matches pause the action and require Allow once.
- Email addresses and labeled private information are treated as high severity and paused before sending.
- Medium matches are allowed with a short warning.
- Ordinary prompts continue without interruption.
- Checks and redaction happen inside the extension — no authentication, no network request.
- The latest 100 redacted decisions stay in
chrome.storage.local; raw editor contents are not stored.
Supported sites: ChatGPT, Claude, Gemini, Perplexity, Microsoft Copilot, and Grok. Triggers include form submissions, send/submit-style buttons, and Enter from editable prompt surfaces; Shift+Enter still adds a new line.
Rule categories (heuristic, not semantic)
The extension evaluates text against a fixed rule list — private email and labeled PII, destructive commands (rm -rf, DROP TABLE, hard git resets), credential references (.env, SSH paths, password fields), credential text paired with outbound delivery language (critical), live token shapes (critical, with in-place redaction), curl-to-shell and encoded execution patterns, network sweeps, sudo / chmod 777, cloud metadata URLs, persistence targets (authorized_keys, crontab, LaunchAgents), reverse-shell shapes, and instruction-override phrasing. That is the same family of checks described for scanning skills before run, applied to chat composer text instead of a SKILL.md on disk.
Important nuance from the store listing copy in chrome-apps/beam-sentinel/assets/listing.md: live API keys, access tokens, and private key blocks are removed from the message automatically and the send is held so you review the cleaned text — not only blocked with a dialog.
What Beam Sentinel does not do
Stating limits plainly (same credibility principle as what is AI agent monitoring):
| Out of scope | Why |
|---|---|
| Provider-side storage or training | Once you Allow once and send, Sentinel has no visibility into vendor retention |
| File uploads, screenshots, voice | Checks target composer text at submit hooks described in the README |
| Unsupported domains or mobile apps | Host permissions are limited to the six sites above |
| Semantic "is this NDA-covered?" | Pattern matching, not legal or data-classification review |
| Blocking without user action | Pauses require your confirmation; medium severity warns and proceeds |
| Agent tool calls in the IDE | Use the local collector for Claude Code / hook instrumentation |
| Browser-engine or GPU bugs | See WebGPU Deathray — different class entirely |
| Malware in downloaded chat attachments | Not scanned; extension does not intercept downloads |
False positives and false negatives apply: mentioning .env in a benign question can warn; a novel secret format with no token shape can slip through. That is the tradeoff documented for collector scans in MCP security as well — heuristic triage, not proof of safety.
Install and verify (from the README)
Build and load unpacked — no paid service, no Beam account:
bun run --cwd chrome-apps/beam-sentinel build
Then open chrome://extensions, enable Developer mode, choose Load unpacked, and select chrome-apps/beam-sentinel/dist.
Toggle protection from the toolbar popup; review the last redacted decisions there. For the full rule source and tests, see chrome-apps/beam-sentinel/src/rules.js and rules.test.js in the repo.
How this fits next to Beam on coding agents
Think of two layers on one workstation:
Coding agent (Claude Code, Cursor, …) → sentinel-collector hooks / ingest → local NDJSON timeline
Browser chat (supported assistants) → Beam Sentinel content script → pre-send heuristic pause
Introducing Beam covers the first leg. Sentinel covers the second. Vibe coding security checklist ties both habits together — scan before run, watch after run, and do not treat the chat box as a private scratch pad.
Enterprise readers comparing sanctioned warehouse agents to shadow browser paste should also read enterprise data agents and permissions — Sentinel is a personal guardrail, not a replacement for access control in Snowflake or BigQuery.
Related reading
- How much sensitive data do people share with AI chatbots? — measured paste behavior and breach context
- The Deathray: WebGPU and agent browser risk — untrusted URL rendering, not chat paste
- Introducing Beam: local-first AI agent security — collector, hooks, and scan CLI
- How to vibe code safely with Beam — wiring the collector on your machine
- MCP security: a practical guide — heuristic scanning limits on skills and configs
- AI agent security: securing coding assistants — skill injection and pre-run scan workflow
- Build and load instructions:
chrome-apps/beam-sentinel/README.mdin the Beam monorepo
Beam Sentinel behavior reflects chrome-apps/beam-sentinel/README.md and src/rules.js as of September 12, 2026. The extension is a local prototype; rule IDs and severities may change between releases — verify in the repo before citing exact counts in compliance docs.