Developer shares 5 rules for using AI agents to build Chrome extensions safely

A developer who has shipped eight Chrome extensions outlined five rules he now enforces when using AI agents to write code. The core concern is not whether the code runs, but what agents quietly add — such as extra permissions, external network requests, or new dependencies — without explicit instruction. His rules require the agent to seek approval before broadening permissions, adding analytics or CDN calls, modifying unrelated files, or introducing new packages. The fifth and most critical rule demands that any change affecting what user data is read, stored, or transmitted must be flagged for human review rather than decided silently by the agent. The guidelines reflect a broader principle: for small browser extensions, predictability, minimal permissions, and a clear privacy story matter more than implementation convenience.