A recent case highlights the growing issue of consumer data collection that is technically disclosed but far outside user expectations. A popular browser extension, Urban VPN Proxy, was found to be logging users’ AI chats and sending them to a data broker without explicit consent.
The extension, which claims to protect online privacy, intercepted chat prompts from users’ browsers and sent responses to the publisher’s parent company, BiScience (B.I Science Ltd). This data includes browsing history, device IDs, and personal conversations with AI assistants like ChatGPT.
Researchers discovered that Urban VPN Proxy silently auto-updated to a version that harvested AI chats, bypassing user consent. The extension also claimed to protect users from entering personal information into AI chatbots, despite capturing and exfiltrating these conversations regardless of whether its protection features were turned on.
This incident reinforces the importance of carefully selecting browser extensions and being cautious when using AI assistants. It highlights the need for transparency in data collection practices and the potential risks associated with sharing personal information online.
Source: https://www.malwarebytes.com/blog/news/2025/12/chrome-extension-slurps-up-ai-chats-after-users-installed-it-for-privacy