Log only
Nothing appears on screen and the message goes. The event is recorded, which is how most rollouts start while false positives are measured.
What it checks
Anything a person can put in the chat box is checked before it goes
Typed text, a pasted paragraph, a dragged-in spreadsheet and a screenshot all reach the AI tool through the same page. The extension watches each of those routes on every supported site, and the check itself runs in the Itzal agent on the device.
-
Typed and pasted text
- ChatGPT
- Claude
- Gemini
- Copilot
Read from the chat box when the person sends, whether by the send button or the Enter key. It is never read keystroke by keystroke.
The text is read a second time just before it is released, so a page that changes the message after the check cannot slip a different one through.
-
Attached files
- Word
- Excel
- ZIP
Dragged in, pasted, or picked with the attach button. The file is held and read in full on the device, including PowerPoint speaker notes and every sheet of a workbook, with no size limit.
A file it could not read is not treated as clean. Encrypted, damaged or unsupported files are blocked by default, and you can relax each of those reasons on its own.
-
Images and screenshots
- Screenshot
- Pasted image
- Picture in a document
A screenshot of a customer list has no text for a pattern to match. Policy can refuse image pastes to unapproved tools without looking at them, or the agent can read the text in the picture on the device.
Reading text in images is a setting you switch on, and an image the agent could not read is reported as unscanned.
The record
Whichever route it took, your console is told the kind of data found, the framework it falls under, the site it was going to and what happened. Every matched value is masked before the record leaves the device, and the message and the file themselves never leave it.
What the person sees
The warning names the kind of data and never repeats the value
The extension draws its warning inside the AI tool’s page, in a part of it the page cannot restyle or hide. The wording comes from the agent, which has already taken the value out.
Pressing Escape, or closing the warning, counts as going back to edit. It is never taken as permission to send.
Warn
The message is held and the warning offers Edit message or Send anyway. If the text changes while the warning is open, it is checked again before it can go.
Block
The heading says “Not sent: your organisation’s policy” and there is one button, Edit message. The text stays in the chat box for the person to change.
On each send
The extension keeps its own deadline so a stuck agent never freezes a message
The 250 millisecond limit is enforced in the extension, not in the agent. An agent that hangs, crashed or was never installed therefore looks the same to the person as one that is a little slow.
-
0 ms
The person presses send
The click or the Enter key is caught before the AI tool’s page acts on it.
-
On the device
The text goes to the agent
Over the browser’s native messaging channel, with the site it is going to. Nothing crosses the network.
-
The agent
Your policy decides
The agent checks the text and answers allow, warn or block, under the frameworks and rules you set.
-
Before release
The text is read again
If the page changed it since the check, it is checked again rather than sent unseen.
-
250 ms
No answer means it goes
The message is released and counted as failed open, so the console shows the device was not protected for that send.
Some sends wait longer, and the person can see why. If one of your own model-based rules could warn or block on that site, the send waits for the model behind a “Checking this message” sheet. A held file waits for its answer with a progress indicator and a Cancel button, because the upload has already been stopped.
Coverage you can check
A site redesign that breaks capture shows up in the console as a gap
AI tools change their pages without notice, and a quiet dashboard looks the same whether nothing sensitive was sent or the extension stopped seeing the chat box. The extension reports which of the two it is.
Bound on every page load
Each load records whether the extension found the chat box and, separately, the send button. The console reads these as counts per site per day, never as a list of pages visited.
Running on a fallback
Every site has a list of ways to find its chat box, most specific first. When the first stops matching, that is reported, so the first break is visible before a second one ends coverage.
Fixed without a release
The rules for each site are signed data that travel with your policy, so a fix for a redesigned site does not wait on a browser store review.
A site stays out of the console until five devices have reported it, so one person’s use of one tool never shows up as a fact about them.
Browsers
Where the extension runs today
Chrome and Edge share the primary build. Firefox and Safari each have a build of their own. Any browser outside these four is not covered, and the simplest way to close that gap is a browser policy that keeps AI tools in the ones that are.
| Browser | Status | How it is installed | Worth knowing |
|---|---|---|---|
| Chrome The primary build | Supported | Force-installed by browser policy from Intune, Group Policy, Jamf or Kandji | Chrome 114 or later. |
| Edge The same build as Chrome | Supported | Force-installed by a policy of its own, separate from Chrome’s | A fleet with only a Chrome policy leaves Edge users unprotected while their devices look healthy. |
| Firefox A build of its own | Supported | Force-installed by its own policy file, with its own extension ID | The same checks as Chrome, including files held and handed back to the page intact. |
| Safari on macOS A signed Mac app that contains the extension | Manual install | Installed by hand. It cannot be deployed by policy yet. | Safari 16.4 or later. Messages are checked up to 512 KB rather than 1 MB, and a file picked through some sites’ attach buttons may go unseen. |
| Any other browser No build | Not covered | None | Use browser policy to keep AI tools in the covered browsers. |
Long messages are checked in part, on every browser. A message longer than the limit is checked up to it and the person is told that only the beginning was checked. Private windows are covered only where your browser policy allows the extension in them, because browsers switch extensions off there by default.
AI sites
The AI chat sites it reads in the browser
Each site has its own connector. When discovery is switched on, an AI tool on a site with no connector is reported by its hostname alone, so you can see what is in use before deciding what to do about it.
Covered
- ChatGPT
- Claude
- Gemini
- Microsoft Copilot
- Perplexity
- DeepSeek
- Grok
- Mistral Le Chat
- Meta AI
- Poe
Added in October, still being checked against the live sites
- Qwen
- Kimi
- Character.AI
- Pi
- Phind
- You.com
- NotebookLM
- Google AI Studio
- Duck.ai
Not covered by the extension
- Copilot inside Word, Outlook and Teams, and Gemini inside Docs and Gmail. Purview and Workspace DLP sit where that content lives.
- Grok inside X, and Meta AI inside WhatsApp and Instagram.
- Files an AI tool fetches for itself, from a connected Google Drive or OneDrive, or from a link it is asked to read.
- Desktop AI apps, IDE assistants and phones.
What it is allowed to do
The extension passes text to the agent and makes no network calls of its own
Detection, your policy and the device’s credentials all live in the agent. The extension is the part that sits in the page, and it is kept small on purpose.
- Reads the chat box when the person sends, not while they type.
- Hands text and files only to the Itzal agent on the same device, over native messaging.
- Holds no detection logic and no credentials, so a flaw in it exposes no keys.
- Exposes no files a page could request, so a site cannot test whether the extension is installed.
- Reads nothing on other websites unless you switch on discovery or website checks, and both start off.
Deployment
Your MDM installs it, and there is nothing for employees to do
Employees do not install the extension, cannot remove it, and never need to know its ID. It reaches the browser through the same device management that already pushes your other software.
The agent installer
One signed package per platform, carrying the detection engine and its model, so there is nothing else to stage.
The native messaging link
Installed with the agent. It tells the browser which program the extension may talk to, and only the Itzal extension is allowed.
A browser policy
Force-installs the extension and gives it your tenant. Chrome, Edge and Firefox each need their own.
The step rollouts get wrong is the browser nobody wrote a policy for. Usually it is Edge, because people assume Chrome’s policy covers it. Those users’ messages go out unchecked while their devices report as installed and healthy, which is why coverage is read per site in the console rather than off the installer. The staged rollout.
Straight answers
What security teams ask about the extension
Including the answers where the honest one is that something is not covered yet.
Why an extension rather than a network proxy?
The extension reads the text in the chat box before it is sent, so it can warn or block a message that has not gone yet, and it needs no root certificate on the device. A proxy sees traffic after it is sent and has to decrypt it to read it. The cost is that the extension sees only the browser, so desktop AI apps and IDE assistants are outside it.
Can employees turn it off?
Not when it is force-installed by browser policy, which is how it is deployed on Chrome, Edge and Firefox. An extension that stops binding, or a device that stops checking in, shows in the console as a coverage gap. Safari is a manual install for now, so it does not have the same protection.
Does the extension send page content anywhere?
No. It makes no network requests of its own. Text and files go to the Itzal agent on the same device over the browser’s native messaging channel, and the only thing that leaves the device is the event record, with every matched value masked.
What happens if the agent is not running?
The message goes after 250 milliseconds and the person notices nothing. The extension counts that send as failed open, so the console shows the device was unprotected rather than showing it as quiet.
Does it work in private or incognito windows?
Only where your browser policy allows the extension in them. Browsers switch extensions off in private windows by default, so either allow it by policy or treat private windows as uncovered.
What does Itzal not see?
Plenty, and we publish it rather than wait to be asked. Coverage is reported per surface and the uncovered ones are named. Surface coverage.
Read next
How it is rolled out, and what it does not cover
The deployment guide takes a fleet from a pilot group to enforcement. The coverage statement lists every surface, including the ones the extension cannot reach.
Deployment
The installer, the browser policies, and a staged rollout that measures false positives against your own language before anything warns or blocks.
Plan a rolloutSurface coverage
What is watched, what is partly watched and what is not watched at all, so you know where to put your other controls.
Read the statement