How AI Browser Assistants Handle Form Filling: Autofill, Inference, and Risk

Web forms are everywhere: login screens, checkout flows, government applications, multi-step onboarding wizards. AI browser assistants are increasingly expected to help with these. But what actually happens when an AI extension encounters a form field is more nuanced than most users realize — and the difference between a well-designed and a poorly-designed implementation can matter quite a lot for your privacy and security.

How an AI extension “sees” a form

When an AI extension processes a form, it reads the page’s DOM — the structured tree of HTML elements the browser builds from the page source. For each input field, it looks at:

• The <label> element associated with the input
• The placeholder attribute (the greyed-out hint text)
• The name and id attributes on the input itself
• Any visible text immediately before the input
• The overall page context (what kind of site this is, what the form says it’s for)

From these signals, the AI infers what the field is asking for. A field with name="shipping_address_line1" and a placeholder of Street address is unambiguous. A field labeled only Contact on a site that clearly collects phone numbers for delivery confirmation is less so — and a well-implemented extension will flag that ambiguity rather than guess.

The propose-and-confirm pattern

The single most important architectural difference between a trustworthy form-filling assistant and a dangerous one is whether it proposes a fill for you to approve or automatically submits one without asking.

Automatic, unilateral form submission is a design antipattern even for low-stakes fields. Forms can have unexpected consequences — submitting a support ticket, sending a message, placing an order. An AI that fills and submits without a confirmation step trades a small amount of friction for a real risk of unintended actions.

A well-implemented flow looks like this:

1. You ask the assistant to help fill a form, or click a “fill” button in the extension popup.
2. The extension shows you what it proposes to put in each field — a mapping of field → proposed value.
3. You review, edit any field you disagree with, and then confirm.
4. Only then does the extension programmatically set the field values.

Nothing is submitted. You still click the form’s own Submit button yourself.

Credential fields: the bright line

Passwords, credit card numbers, social security numbers, and similar sensitive fields are a category apart. These should never flow through an AI’s prompt pipeline.

Here’s why: an AI extension’s form-filling suggestions are typically generated by passing a description of the page and the user’s stored context to a language model. That round-trip — page data → LLM → suggested fill — is fine for most fields. But it means that data is being passed outside the browser to a third-party API. For a shipping address, that’s a minor privacy trade-off you might accept. For your banking password, it is categorically unacceptable.

Good implementations handle this by detecting password fields (any <input type="password">) and deferring to the browser’s built-in credential manager or a connected password manager rather than touching them. The AI sees that the field exists but never touches its value.

Browser autofill — Chrome’s native password fill — operates entirely locally. Your credentials never leave the browser. This is the right layer to handle credentials, and any AI extension that doesn’t integrate with or defer to that layer for sensitive fields should be treated with serious caution.

What Browsy does with forms

Browsy’s approach to forms reflects the principles above. When you ask Browsy for help on a page with a form, it reads the page’s structure and context to explain what the form is asking for, identify any fields that are confusing or require specific formatting, and suggest values where you’ve given it relevant context. Proposed fills are presented for your review before any values are placed in the form.

Credential fields are out of scope for Browsy’s suggestions — it detects them and notes that your password manager or browser should handle them. This isn’t a limitation; it’s the correct security boundary for any AI tool operating in a browser context.

Form filling vs. form understanding

There’s a distinction worth drawing between filling a form and understanding one. Many forms are confusing — fields with unclear labels, unusual validation requirements, multi-step flows where it’s unclear what you’ve agreed to. An AI assistant that explains what each field wants, flags anything that seems unusual in the context of what you’re doing, and helps you understand what you’re submitting is genuinely useful regardless of whether it physically enters any values for you.

This kind of contextual guidance is often more valuable than autofill, and it carries none of the same risks — the AI is reading the page, not writing to it.

What to look for when evaluating a form-filling extension

If you’re evaluating an AI browser extension that includes form-filling capabilities, the questions that matter most are:

• Does it propose before it fills, or does it fill automatically?
• Does it explicitly handle credential fields differently from regular fields?
• Where do the values it’s suggesting come from — stored locally, or pulled through a cloud API each time?
• Can you see exactly what it’s proposing to put in each field before it does anything?

The answers to those questions tell you more about how seriously the extension treats your privacy than any marketing copy will.