Tech Desk 
Dec 17, 2025
An undated image. — Unsplash
Security researchers have issued a warning about several Google Chrome and Microsoft Edge extensions that are quietly collecting and selling users’ private conversations with AI chatbots.
Cybersecurity firm Koi revealed that a group of popular browser extensions harvest AI chats by default and share the data with third parties.
Extensions sells your AI conversations
As described by Koi, the malicious extensions do not limit themselves to one service but intercept conversations from several platforms such as ChatGPT, Google Gemini, Claude, Microsoft Copilot, Perplexity, DeepSeek, Grok by xAI, and Meta AI.
Any user who may have had the extensions installed might have been affected by this bug.
Koi discovered that there are built-in scripts for executors included in the extensions, whose purpose is to record conversations between AI systems running within browser tabs.
The scripts are readily enabled and cannot be disabled by altering settings. The only way to opt out is by completely uninstalling the extensions.
The company stated that the extensions harvest a lot of data, including user requests, responses from the AI, the date and time, conversation identifiers, session information, and information regarding the AI model employed.
All the data is consequently resold to third parties for marketing and analytics purposes. The extensions are said to track web activities and inject platform-specific scripts each time an AI application is accessed.
The commonest one is Urban VPN Proxy, with six million users in the Chrome Web Store. Koi found other instances of this same type of data-extracting code in at least seven other associated browser extensions, including 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker, which were used with Chrome or Edge browsers.
Although being advertised as privacy-related or security solutions, most of these extensions feature “Featured” tags. Koi pointed out that users were warned to remove the following extensions immediately and assumed that any conversation with an AI since July 2025 could have been harvested and distributed.
