This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Security researchers discovered that the Urban VPN Proxy browser extension and seven related extensions from Urban Cyber Security Inc. began silently harvesting and exfiltrating private user conversations from major AI platforms starting July 9, 2025. The data, which includes sensitive personal, financial, and professional information, is collected without a user-facing opt-out and sold to affiliated data brokers. Despite the invasive nature of this data collection, the extensions maintained 'Featured' badges on the Chrome Web Store, misleading millions of users into trusting the software for privacy.
Security researchers reported that the Urban VPN Proxy browser extension introduced AI conversation–harvesting functionality in version 5.5.0, released July 9, 2025. The extension allegedly intercepted and exfiltrated private conversations from AI platforms including ChatGPT, Claude, Gemini, Grok, and others without a user-facing opt-out. The data, including sensitive personal and financial information, was reportedly shared with affiliated data brokers for commercial analytics.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The incident highlights how users' deep trust and candor with AI assistants led them to share highly sensitive personal details, making the exfiltration of these conversations exceptionally damaging.
The browser extensions silently harvested and exfiltrated highly sensitive, non-public personal conversations from AI platforms, directly compromising user privacy.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data harvesting was caused by the intentional decision of the extension developers to inject scraping scripts into users' browsers post-deployment of the AI systems.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
A massive data harvesting campaign by Urban Cyber Security Inc. used browser extensions to silently exfiltrate private AI conversations from over 8 million users. While constituting a severe privacy violation and exposing proprietary code and personal data to data brokers, the incident represents a minor national security threat primarily managed through standard cybersecurity and privacy regulations.
The reports describe users interacting with AI platforms like ChatGPT, Claude, and Gemini as conversational assistants to help with personal decisions, coding, and answering questions. These systems act as assistants by providing information and suggestions based on direct user prompts without taking independent actions.
Risk Level 3: Limited Risk. The report describes users interacting with chatbots such as ChatGPT, Claude, and Gemini, which are explicitly categorized as Limited Risk systems requiring transparency under the EU AI Act.
The AI systems involved (ChatGPT, Claude, Gemini) are general-purpose conversational chatbots designed to answer user questions, assist with tasks, and engage in dialogue.
The reports provide highly detailed technical analysis of the exfiltration mechanism, including specific script names, API overrides, and data destinations. The scale of the incident (over 8 million users) and the specific extensions involved are clearly documented by security researchers, with corroborating coverage from multiple tech news outlets.
None. The technical evidence of silent data harvesting is clear and uncontested.
Technology
Script Injection Overriding Fetch API
Injected scripts override fetch/XHR to intercept AI prompts and responses.
Lack of User-Facing Toggle
Users cannot disable AI harvesting without completely uninstalling the extension.
Silent Background Execution
Data harvesting runs continuously even when the VPN is disconnected.
Data Inputs
Harvesting of Sensitive AI Prompts
User prompts containing medical, financial, and proprietary data are captured.
Interception of AI Chat Responses
AI-generated outputs are exfiltrated along with the user's input queries.
Collection of Session Metadata
Conversation IDs, timestamps, and model details are gathered and exfiltrated.
Human Factors
Overreliance on Featured Badges
Users trusted the extension because of Google's 'Featured' endorsement.
Uninformed Consent and Dark Patterns
The consent prompt framed AI monitoring as a protective safety feature.
High Candor with AI Chatbots
Users share highly sensitive personal details with AI, assuming privacy.
Process and Methods
Inadequate Extension Store Review
Google and Microsoft manual reviews failed to flag the harvesting code.
Silent Extension Auto-Updates
The harvesting code was pushed silently to existing users via auto-updates.
Contradictory Store Declarations
Store listings claimed no third-party data sales, contradicting the policy.
Management
Monetization Prioritized Over Safety
Urban Cyber Security monetized user data by sharing it with BiScience.
Deceptive Marketing of AI Protection
Management framed data harvesting as an 'AI protection' security feature.
Lack of Corporate Ethical Standards
Management knowingly updated privacy policies to exploit sensitive user chats.
Regulatory Environment
Weak Extension Store Enforcement
Stores failed to enforce policies against selling data to data brokers.
Lack of AI Data Privacy Laws
Absence of strong regulations preventing third-party scraping of AI chats.
Permissive Data Broker Oversight
Data brokers operate with minimal oversight regarding harvested AI data.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
