Browser extensions with 8 million users collect extended AI conversations

If you’re running a small business and rely on AI chatbots like ChatGPT or Gemini for quick insights, watch out—extensions such as Urban VPN Proxy and its shady siblings have been secretly hoovering up every prompt, response, timestamp, and session detail from eight major AI platforms, racking up over 8 million installs across Chrome and Edge. These extensions pull this stunt independently, so flipping off their VPN or ad-blocking features won’t stop the data grab; you’ve got to manually disable or uninstall them to cut it off. Discovered by security researchers, this mess kicked off in early July with Urban VPN’s update, potentially exposing sensitive SMB chatter like financial queries or proprietary code to marketers and data brokers. While these extensions hypocritically tout “AI protection,” they’re basically turning your private AI sessions into profit fodder, so tech-savvy pros should always scrutinize extension permissions and read the fine print before installing anything that promises the world. For MSPs managing client setups, make it a habit to audit browser add-ons regularly to avoid handing over valuable data to opportunistic third parties.

Source: https://arstechnica.com/security/2025/12/browser-extensions-with-8-million-users-collect-extended-ai-conversations/