Security researchers catch "privacy" browser extensions siphoning AI chats and selling them via a data broker

If you use a chatbot and an Urban browser extension, you might want to rethink that combination. Security researchers at Koi have found that eight browser extensions with more than eight million users combined are secretly harvesting AI conversations and potentially selling them to third parties.

The extensions intercept conversations with ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI. Even when the VPN is switched off, data collection continues in the background. Uninstalling the extension is the only way to stop it.

According to Koi, the data collection feature was quietly added in July 2025 through an automatic update. The data goes to Urban VPN's servers, and the privacy policy states that browsing data is shared with affiliate BiScience and that AI prompts are used for marketing analytics.

But the provider tells a different story in the Chrome Web Store, claiming data is not sold to third parties. Adding to the confusion, "Featured" badges from Google and Microsoft give users a false sense of security. Urban Ad Blocker for Edge is the only extension without a Featured badge.