What I got wrong building a browser extension with an AI assistant

Once I went looking, I found several products with some of the same features. Nobody had my exact combination, but the sketch was never the moat. Everything after the sketch was.

Referral behaviour, what happens when a trial expires mid-session, how translations work across a page — none of it was in my head at the start. Each became a decision made while building the product, under pressure, halfway through something else. Write the workflow down first.

Confidently. I deployed more than once to find the fix I'd been told about was never written. Treat every claim of completion as unverified.

The rule that came out of it: make it prove the code is right before it theorises about what you did wrong.

Long replies made it hard to tell which of my five points got addressed. Numbering my instructions, and making it map answers back to the same numbers, turned "did you do item 3" into a question with an answer.

Two landing page changes; one appeared, one didn't. Its verdict: "you didn't deploy." I said one change was live. It repeated that I hadn't deployed. It never asked which change I could see, and never reopened its own code — where the bug was. I swore at it. It stopped guessing, checked, and found the error in a minute. Sometimes escalation is the only thing that works, which is its own uncomfortable takeaway.

Make it restate what it's about to do. Half my wasted hours were a confident assistant building something I hadn't asked for, fluently, while I assumed we were agreed.

It rebuilt a related-links section across 20 pages by pulling titles from a data file. One record was missing an optional field, so it ran off the end and pasted raw internal data into visible content. Verification scripts passed. Only reading the actual output caught it.

• The store takes your extension's name and description from a file inside the package, not the dashboard where you wrote them. Ours still carried an old product name and old wording. The dashboard is what you're looking at; the package is what ships.
• A "rate us" button had an ID hardcoded from local testing. It would have 404'd for every store user.
• Sign-in silently dropped overnight. Days to find, because it only appeared after long idle periods. The cause was three default settings on a server-side client that need turning off.

We described explanations as "instant." Then for about a week the model was slow enough that "instant" was a lie, so we changed every listing, every screenshot caption, and the site to "immediate" — and added a fallback model so a slow provider degrades instead of stalling. Your copy is a claim about infrastructure you don't control.

An extension directory rates ours high risk. The reason, in full: we declare access to five domains — our backend, the three AI providers users can bring their own key for, and our own site.

A 2025 study from UCL, UC Davis and Mediterranea University, presented at USENIX Security, examined ten popular AI browser assistants and found several transmitting full page content to their servers, one capturing form inputs including banking and health data, and several profiling users by age, gender and income. The scores and the study measure different things. Worth knowing which one you're reading.

Discount codes and referral attribution have no interface to check. We verified them with database queries — asking the data, not the interface, and not the assistant.

Page build rules, UI mockups, how referrals work, how trials behave, translation structure. A new session starts from documents or it starts from nothing. Retyping a briefing each time means eventually leaving something out.

It doesn't reliably update the version it's holding, so it edits an old copy — reverting fixes, overwriting work, and producing a mess that looks like progress. My rule: paste the latest file, ask for the specific change in that file, and make it confirm nothing else changed. You still check yourself, but it cut the problem down sharply.

The product explains things using real-world analogies. Testing, I highlighted a politician's name in a news article. It returned an analogy about the loudest clown in the circus who always needs to be heard. Funny. Not shippable in a tool explaining the news to strangers across the political spectrum in fifteen languages. Neutrality became an enforced rule, with guardrails for real people, historical figures, and sensitive topics. The product also has a Slang mode, which explains the same facts in a casual internet voice. What Slang mode produced for that politician is not printable on a company website.

We publish free explainer pages. I found our explanation of “synergies” quoted nearly verbatim in a Google AI answer. That was luck — the pages happened to be structured in a way machines could read cleanly. So we made it deliberate: real headings on every section, labelled explanation depths, the formal definition marked as what it is. The structure was already the differentiator; it just wasn't visible to anything but a human.

Google sign-in worked. What it showed was a screen of random characters asking users to sign in to Supabase — our database provider, a company nobody has heard of, on an extension installed ten minutes ago. That looks exactly like being hijacked.

Fixing it meant domain verification with Google, which rejected us for not describing the tool's purpose on our landing page. The landing page describes it, prominently. Then the status said Google had emailed us and we should reply. No email arrived — apparently common. Posting on the developer forum is what finally unstuck it.