Privacy policy: Bandit Stealth for Chrome
Burtson Labs · Last updated 8 November 2026 · Applies to version 0.1.0 and later
Bandit Stealth for Chrome ("the extension") lets the Bandit agent that runs on your own computer read and act on web pages, in a browser tab group you can see and on sites you have granted. This page describes what the extension reads, where that data goes, and what is stored. It covers the extension in Google Chrome, Microsoft Edge and other Chromium browsers.
Summary
- The extension makes no network requests of its own. It has no analytics, no crash reporting and no server of ours to talk to.
- It talks only to the Bandit command-line program (the "Bandit CLI") on the same computer, through the browser's native messaging.
- Page content the agent reads goes to the Bandit CLI, which sends it to the AI model provider you chose. With a model on your computer (for example Ollama), nothing leaves your computer.
- Burtson Labs does not receive data from the extension, does not sell data, and does not use it for advertising.
What the extension reads
Only on sites you have granted, only in tabs in the agent's "Bandit" tab group, and only when the agent asks while doing a task you gave it:
- the visible text of the page and a list of its interactive elements (for example a button's label or a field's current value);
- the page's console messages, uncaught errors and failed network requests;
- a screenshot of the visible tab, when the agent asks for one;
- the web address and title of tabs in the Bandit tab group.
It never reads the contents of password, one-time-code or payment fields, and never types into them. It does not read tabs outside the Bandit group, browser or extension pages, or web store pages. It does not run in incognito windows. No site is granted at install; you grant and revoke sites one at a time in the side panel.
Where the data goes
| Recipient | What | When |
|---|---|---|
| The Bandit CLI on your computer | The page data listed above | Each time the agent reads a page |
| The model provider you selected in Bandit | The page data the agent read, as part of the conversation, like any other tool output | Each agent turn. With a local model, this stays on your computer. With your own key for a provider such as OpenAI or Anthropic, that provider receives it under its terms. If you select Bandit Cloud, Burtson Labs receives it as the model provider, under the Bandit Cloud terms. |
| The sites the agent opens | Whatever those pages request, as when you browse them yourself | When the agent opens a page or acts on it, in your browser and with your cookies |
The Bandit CLI has an optional telemetry feature that is off unless you turn it on. When on, it sends tool names and the first 120 characters of each tool's main argument (for a browser tool, the web address), never page text, to the telemetry endpoint you configure. See the Bandit network and privacy documentation for details.
What is stored, and where
| Where | What | How long |
|---|---|---|
| Extension storage (local) | Your per-site "Allow actions" setting | Until you change it or remove the extension |
| Extension storage (session) | Sites waiting for your answer and the recent-actions list. Recent actions record how many characters were typed and into which field, never the text. | Until the browser closes |
| Your browser | The sites you granted, as extension site permissions | Until you revoke them |
Your computer, under ~/.bandit/ | Sites you allowed actions on; an audit log with one line per decision (site and element, never page content, typed text or screenshots); the time the extension last started the Bandit host | Until you delete them |
Nothing is synced to your browser account or to Burtson Labs.
Your choices
- Revoke any site in the side panel, or remove the extension's site access in the browser's extension settings.
- Press Stop Bandit on the page or in the side panel to end the current task.
- Choose a model that runs on your computer so that page content does not leave it.
- Run
bandit chrome uninstallto remove the native messaging registration, and remove the extension from the browser.
Children
The extension is a developer tool and is not directed at children.
Changes
If this policy changes, the new version is posted at this address with a new "Last updated" date. Material changes are noted in the extension's release notes.
Contact
Burtson Labs · team@burtson.ai
Installation and support: Bandit Stealth for Chrome.