Is TabAI — AI Task manager for All Your Tools safe?
We analyzed TabAI — AI Task manager for All Your Tools version 3.5.5.1's actual code and gave it a 24/100 trust score. TabAI provides useful task features…
Bottom line
TabAI provides useful task features but combines them with unusually broad access, extensive data collection, remote-controlled actions, and a serious session-handling weakness.
What it can access
It can access every website, visible page text, tabs, bookmarks, sessions, and recording features, exceeding what a task manager ordinarily needs.[Q1][Q3][Q4][Q5]
Security weaknesses
Any website can supply login values to an exposed callback, which stores them without adequate origin or request verification.[Q21]
Signs of misuse
It sends tab and task information to its services, can collect optional activity and form metadata, and lets its server trigger browser actions.[Q6][Q12][Q15][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site access plus tabs, scripting, bookmarks, sessions, web requests, tab capture, identity and extensive tab/window controls. Much supports its advertised AI workspace, but the scope is exceptionally broad.
Declares <all_urls> and permissions for tabs, scripting, tab groups, windows, bookmarks, sessions, identity, webRequest and tabCapture. — manifest.json:3
Which websites can it run on, and can it read or change what appears on those pages?
It injects a widget and activity listeners into every completed HTTP/HTTPS page. It can extract readable text when asked and display full-page focus overlays.
Injects content-scripts/content.js into every completed non-protected tab. — background.js:15
Creates high-z-index widget/toast iframes and serves page-context requests. — content-scripts/content.js:189-211
Can execute a packaged page-reading function in a selected tab. — background.js:41
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
On demand, it reads up to 12,000 characters of visible page text. The reader excludes forms, password fields and credit-card inputs, but other sensitive page content can still be included.
read_page executes in the chosen tab, extracts visible text and excludes FORM plus password/card inputs in readable mode. — background.js:41
A lighter page-context handler returns headings, description and visible text to the background worker. — content-scripts/content.js:211
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It can read bookmarks, recently closed sessions, all open tabs and local extension data. It does not request cookie access.
Declares bookmarks, sessions, tabs and storage but no cookies permission. — manifest.json:3
Uses bookmarks.search and sessions.getRecentlyClosed in the side-panel interface. — chunks/sidepanel-DXH_xY_d.js:2
Builds AI context from all open tabs and groups. — background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It includes microphone/voice and tab-audio recording capability. Recording is tied to user-facing meeting or voice controls; no automatic background recording path was found.
Declares tabCapture and offscreen permissions. — manifest.json:3
Uses MediaRecorder and desktop-audio getUserMedia only after an internal START_RECORDING message. — chunks/offscreen-Bh4BSiyc.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
AI chats send the prompt, current task and every open tab's title and URL to services.tabai.dev. Task data syncs there, and product analytics with a persistent ID go to PostHog.
buildChatContext collects all tabs/groups and chat POSTs the request to api.tabai.dev. — background.js:1
Authenticated task/list delta sync includes descriptions, associated tab URLs, subtasks and domain-time data. — background.js:1
PostHog sends product events and a distinct ID to us.i.posthog.com. — background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
TabAI's server returns structured tool instructions that packaged code executes. These are not JavaScript, but they can invoke privileged browser and task operations.
Parses response tool_calls and dispatches each function name and arguments to executeToolCall for up to five rounds. — background.js:1
The dispatcher supports page reading, tab changes and task/list changes. — background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically injects its script on page loads, tracks active-tab time when Memory is enabled, syncs task changes, and can redirect blocked sites during Focus mode.
Injects the content script when tabs finish loading and applies focus blocking on navigation. — background.js:15
Memory tracking is gated by the enabled setting; task sync runs for authenticated users. — background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares none of the proxy, search, privacy or management permissions needed for those changes. — manifest.json:3
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Minified bundle retains readable API endpoints, tool dispatch, memory settings and browser calls. — background.js:1-41
Large minified React/content-script bundle is static packaged code. — content-scripts/content.js:1-212
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
CSP includes wasm-unsafe-eval but keeps script-src restricted to self. — manifest.json:3
Package inventory contains no WebAssembly payload. — inventory.json:1-416
Does it track the websites, pages, searches, or links you visit?
If the user enables Memory, it records visited URLs, titles, active time and page events for 30 days by default. The feature is off by default and stores records in local IndexedDB.
Memory defaults to disabled, tracks visits/focus time when enabled and retains data for 30 days. — background.js:1
The settings UI presents an explicit Enable memory capture switch and retention controls. — chunks/options-CYKur6ti.js:131
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent PostHog analytics ID and can replace it with the signed-in account ID. This tracks product events, not ordinary browsing contents.
Creates tabai-posthog-distinct-id, sends extension events to PostHog and supports account identification. — background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It stores TabAI access and refresh tokens locally and sends them only to TabAI services. However, the exposed OAuth callback accepts URL-supplied tokens without state or origin validation, allowing another site to overwrite the stored session.
Stores access and refresh tokens in chrome.storage.local. — chunks/token-storage-CbwoaW9K.js:1
Reads access_token and refresh_token from its query string and stores them before any opener check. — chunks/oauth-callback-CXjEFJGA.js:1
Exposes oauth-callback.html as a web-accessible resource to every website. — manifest.json:3
Does it record typing, form entries, clipboard contents, or screenshots?
With Memory enabled, it records selected/copied text and form submission metadata, including destination, field names and whether a password field exists. It does not record form values in the observed path.
Listens for selection, copy and submit events and sends text or form metadata to the background worker. — content-scripts/content.js:150
Discards MEMORY_EVENT messages unless Memory is enabled and blocks configured sensitive hosts. — background.js:15
Can a website or remote server send commands that make the extension take actions?
After the user starts a chat, TabAI's server can return commands to read pages, open/close/focus/group tabs, redirect focus-blocked pages, or change/delete task data. Only integration connection pauses for user action.
Executes response tool_calls immediately and loops with the results; most supported tools perform their action directly. — background.js:1
close_tabs calls tabs.remove, open_tab calls tabs.create, read_page runs page extraction, and task deletion mutates local/synced data. — background.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds hidden widget/toast iframes that expand for chat and notifications. — content-scripts/content.js:189-211
Displays the focus block page and lets the user return, allow once or start the next task. — chunks/focus-block-M0wcBCjh.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
Focus mode can redirect tabs to a packaged block page. A broad webRequest listener observes HTTPS and localhost integration-callback URLs, but it does not alter request headers, downloads or proxy settings.
Updates blocked tabs to focus-block.html and watches /integrations callback URLs. — background.js:15
Declares webRequest but not declarativeNetRequest, downloads or proxy. — manifest.json:3
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Allows localhost and 127.0.0.1 hosts plus local connect-src destinations. — manifest.json:3
Observed localhost use is an OAuth/integration callback listener, not a command channel to native software. — background.js:15
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote tool names are dispatched through a fixed switch of packaged handlers. — background.js:1
Extension script execution remains restricted to packaged self code. — manifest.json:3
Can ordinary websites access privileged extension features through messaging or exposed files?
An ordinary website can load the web-accessible OAuth callback with chosen access and refresh tokens. The callback stores them without state, source or origin validation, enabling TabAI session fixation.
Makes oauth-callback.html accessible from <all_urls>. — manifest.json:3
Consumes query-string tokens and calls setTokens before checking window.opener. — chunks/oauth-callback-CXjEFJGA.js:1
setTokens writes both values into privileged extension local storage. — chunks/token-storage-CbwoaW9K.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The most invasive memory capture is off by default, page snapshots are separately optional, and banking/login/health/government hosts are blocked. However, the 'never uploaded' disclosure is inaccurate when memory results are returned to the AI server.
Memory defaults to disabled with captureContent false and a sensitive-site blocklist. — background.js:1
Settings say all memory data stays on-device and is never sent. — chunks/options-CYKur6ti.js:131
what_am_i_doing_now returns memory records as a tool result, which the next chat request sends to api.tabai.dev. — background.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
No mining pool, wallet or proof-of-work logic appears in the background services. — background.js:1-41
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The submit listener reads action, field names and password-field presence without writing to the form. — content-scripts/content.js:150
Stores this metadata only when Memory is enabled and the host is not blocked. — background.js:15