Browser Extensions Harvest AI Data from 8 Million Users

Security researchers have exposed a widespread data harvesting scheme embedded in popular browser extensions, compromising conversations from more than eight million users across major AI platforms. The primary culprit, Urban VPN Proxy, a free VPN tool with over six million installs on the Chrome Web Store, secretly captures users' prompts, responses, and metadata from services like ChatGPT, Gemini, Claude, and Microsoft Copilot, according to findings from cybersecurity firm Koi.

The extensions, which include Urban VPN Proxy and seven others from the same publisher such as 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker, operate on both Google Chrome and Microsoft Edge. Koi's analysis revealed that these tools inject custom JavaScript scripts into AI websites, overriding core browser functions like fetch and XMLHttpRequest. This interception allows the extensions to siphon off every element of user interactions, including timestamps, conversation IDs, and session details, before the content even appears on the user's screen. The captured data is then compressed and transmitted to servers controlled by the extensions' operator, Urban Cyber Security Inc., regardless of...