A browser extension can seem like a simple tool: install it, switch on a VPN when you need one, and get on with browsing. But an investigation described by Futurism raises a more unsettling question: what else might an extension do while it is installed?
The article reports on findings by security firm Koi about Urban VPN Proxy, a free extension for Google Chrome. At the time of publication, it had about six million users, according to the report. Koi researcher Idan Dardikman said scripts in the extension captured conversations with several AI chatbots, including ChatGPT, Claude, Gemini, DeepSeek and Grok.
The detail that stands out is that, according to the investigation, this collection happened whether or not the VPN was switched on. The scripts were enabled by default, and the article says users had no setting inside the extension to switch off the collection. Futurism, citing Forbes, reports that uninstalling the extension was the only way to stop it.
Why does that matter? People may type almost anything into an AI chatbot. The article gives examples such as medical questions, financial details, proprietary code and personal dilemmas. If information entered into a chatbot is collected by a browser extension, it may travel beyond the conversation users thought they were having. Futurism says the data was collected for marketing analytics.
The article also describes a possible route for that information. Urban VPN Proxy’s privacy policy says browsing data is shared with BiScience, an affiliated data broker. According to the report, BiScience uses raw data to create insights for commercial use and sharing with business partners. The Chrome Web Store page, however, makes statements that data is not sold outside approved uses and is not transferred for purposes unrelated to the extension’s core functionality. Those descriptions make it important for users to look closely at what a tool collects and how its policies explain the use of that information.
The report says the issue may extend beyond one extension. Citing Forbes, Futurism says seven other apps from the same publisher, with more than two million customers combined, had identical AI-harvesting functionality. All but one reportedly carried a “featured” badge in the Chrome Web Store.
There are limits to what the article establishes. It does not independently verify the user and customer counts, say how many conversations were captured, or identify which commercial partners received data. It also does not establish whether the practices broke any law or platform rule. So the report is not proof that every browser extension, or the wider data-scraping industry, behaves this way. It is a reminder to consider what we type into online services—and to check the permissions and privacy information attached to the tools we install.
Source: Millions of Private ChatGPT Conversations Are Being Harvested and Sold for Profit, Futurism
Leave a Reply