Cybersecurity firm Koi has uncovered a massive data collection operation involving a Google Chrome browser extension that contained scripts to record users' conversations with chatbots, which could be sold to marketing companies.
Cybersecurity firm Koi has uncovered a massive data collection operation involving a Google Chrome browser extension that contained scripts to record users' conversations with chatbots, which could be sold to marketing companies.
Futurism reports that the free Urban VPN Proxy extension, which has about six million users and even a «recommended» badge in the Chrome Web Store, goes beyond typical VPN functionality and includes scripts designed to intercept and record conversations from various artificial intelligence platforms, including OpenAI’s ChatGPT, Anthropic’s Claude, Google’s Gemini, DeepSeek, and xAI’s Grok.
The data collected includes anything a user might ask their chosen AI chatbot. Koi says it could be «medical questions, financial details, custom code, personal dilemmas,» and it’s all sold for «marketing analytics purposes».
In this case, Urban VPN Proxy constantly collects conversation data, regardless of whether the user has enabled VPN or not. The script is enabled by default, and from the moment the extension is loaded, the user’s conversations in the chatbot become available for collection. The user has no option to disable this feature, and the only way to stop data collection is to completely uninstall the extension.
Koi notes that the developer, Urban Cyber Security Inc., clearly states in its privacy policy that it shares browsing data with its affiliate, a data broker called BiScience. It uses this raw data and «creates analytical insights that are used for commercial purposes and shared with business partners.»
However, the Urban VPN Proxy page in the Chrome Web Store states that «data is not sold to third parties except for approved use cases» and «is not used or shared for purposes unrelated to the core functionality of the product».
Seven other extensions from Urban Cyber Security Inc, with a combined total of two million users, also have «identical AI-powered data collection functionality.» All but one have a «recommended» badge from the Google Chrome Web Store.
«If you have any of these extensions installed, uninstall them immediately. Consider that all your conversations with the AI you have had since July 2025 have been recorded and shared with third parties», say the Koi researchers.
