Ad blockers and VPNs are supposed to protect your privacy, but four popular browser extensions have been doing just the opposite. According to research from Koi Security, these pernicious plug-ins have been harvesting the text of chatbot conversations from more than 8 million people and sending them back to the developers.<\/p>\n
The four seemingly helpful extensions are Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker. They’re distributed via the Chrome Web Store and Microsoft Edge Add-ons, but include code designed to capture and transmit browser-based interactions with popular AI tools.<\/p>\n
“Urban VPN Proxy targets conversations across ten AI platforms,” said Idan Dardikman, co-founder and CTO of Koi, in a blog post<\/a> published Monday.\u00a0<\/p>\n The research firm said that the platforms targeted include ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI.<\/p>\n “For each platform, the extension includes a dedicated ‘executor’ script designed to intercept and capture conversations,” said Dardikman, who explained data harvesting is enabled by default through a hardcoded configuration flag. “There is no user-facing toggle to disable this. The only way to stop the data collection is to uninstall the extension entirely.”<\/p>\n According to Dardikman, the Urban VPN Proxy extension monitors the user’s browser tabs and, when the user visits one of the targeted platforms (e.g., chatgpt.com), it injects the “executor” script into the page.<\/p>\n “Once injected, the script overrides fetch()<\/a> and XMLHttpRequest<\/a> \u2013 the fundamental browser APIs that handle all network requests,” he explained. “This is an aggressive technique. The script wraps the original functions so that every network request and response on that page passes through the extension’s code first.”<\/p>\n The script parses the intercepted API responses and then packages and transmits the data via window.postMessage<\/a> to the extension’s content script<\/a>, along with the identifier PANELOS_MESSAGE. The content script then passes the data to a background service worker<\/a> for exfiltration over the network to endpoints at analytics.urban-vpn.com and stats.urban-vpn.com.<\/p>\n The Register reached out to Urban VPN, affiliated company BiScience, and 1ClickVPN at their respective privacy email addresses. All three requests bounced.<\/p>\n Pointing to prior investigative material published by security researcher Wladimir Palant<\/a> and John Tuckner<\/a> of Secure Annex that details BiScience’s collection of clickstream\/browsing history data, Dardikman said his company’s findings show BiScience expanding into the collection of AI conversations.<\/p>\n He notes that while Urban VPN does disclose AI data collection during the setup prompt and in its privacy policy<\/a>, the Chrome Web Store listing indicates that data is not being sold to third parties outside approved use cases and that AI conversations are not specifically mentioned.<\/p>\n “The consent prompt frames AI monitoring as protective,” he said. “The privacy policy reveals the data is sold for marketing.” He adds that users who installed Urban VPN prior to July 2025 would have never seen the consent prompt, which was added via a silent update with version 5.5.0.<\/p>\n He also argues that the software provides no indication that data collection happens even when the VPN is not active.<\/p>\n Dardikman notes that\u00a0Urban VPN received a Featured Badge from the Chrome Web Store team.<\/p>\n “This means a human at Google reviewed Urban VPN Proxy and concluded it met their standards,” he said. “Either the review didn’t examine the code that harvests conversations from Google’s own AI product (Gemini), or it did and didn’t consider this a problem.”<\/p>\n He observes that the Chrome Web Store policies explicitly prohibit transferring or selling user data to third party data brokers like BiScience.<\/p>\n Google did not immediately respond to a request for comment.<\/p>\n The problem appears to be a loophole in Google’s Chrome Web Store Limited Use policy<\/a>, which allows data to be transferred to third parties for limited scenarios (e.g., security or business ownership change) that do not include transferring data to data brokers.<\/p>\n