OpenAI ships a gated browser-control runtime inside its new ChatGPT extension
Inspection of Chrome extension version 1.26.1005.11759 found a local JavaScript environment and a direct server connection that could eventually remove the desktop-app requirement. The code also includes an approval-based handoff for email verification codes; neither workflow was verified in a desktop-free session.
By Ryan Merket · Published · Updated
RUNTIMEWIRE INVESTIGATION — Original analysis
Original reporting by RuntimeWire, based on reverse engineering, documents.
Why it matters
OpenAI is moving ChatGPT closer to the browser sessions where work already happens. That creates a distribution advantage, while making site permissions, private account access and safe execution central product questions.
Reporting record
Finding
Inspection of the installed ChatGPT Chrome extension found gated browser-control infrastructure that can register sessions with OpenAI’s server and poll for browser commands, but did not establish a working desktop-free session.
How we verified
Methods: reverse engineering, documents.
The inspected extension was version 1.26.1005.11759 and included the 'chrome-standalone-js-kernel' feature flag, a sandboxed JavaScript runtime, an MCP server named 'node-repl-work', and session registration and tunnel polling endpoints. OpenAI’s setup instructions still direct users to connect through the desktop app.
Inspected the installed extension’s bundled code, including its browser-control and OTP-handling paths, and compared the implementation with OpenAI’s published setup instructions and release notes. No desktop-free session was verified.
Reproduction
RuntimeWire was not able to independently reproduce the finding.
Company response
The company was not contacted before publication.
An inspection of OpenAI's installed ChatGPT Chrome extension, version 1.26.1005.11759, found a browser-control runtime behind the feature flag 'chrome-standalone-js-kernel'. The code points toward a setup in which OpenAI's servers send browser tasks to a JavaScript environment running inside the extension, using the user's signed-in browser session. The implementation is present in the extension; a working session without the desktop app has not been verified.…