Introduction to the Issue
A recent discovery by the security firm Koi has uncovered a shocking invasion of electronic privacy. Eight browser extensions, including Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker, have been found to harvest conversations from various AI platforms, including ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, and Meta AI.
What Data is Being Collected?
The extensions collect a wide range of data, including:
- Every prompt a user sends to the AI
- Every response received
- Conversation identifiers and timestamps
- Session metadata
- The specific AI platform and model used
This data can include deeply personal information about users’ physical and mental health, finances, personal relationships, and other sensitive information.
How the Data Collection Works
The executor script that collects the data runs independently from the VPN networking, ad blocking, or other core functionality of the extensions. This means that even when a user toggles off VPN networking, AI protection, ad blocking, or other functions, the conversation collection continues. The only way to stop the harvesting is to disable the extension in the browser settings or to uninstall it.
Affected Extensions and Users
The eight extensions with identical AI harvesting functionality have been installed more than 8 million times. The affected extensions are:
- Urban VPN Proxy (6 million users on Chrome, 1.32 million users on Edge)
- 1ClickVPN Proxy (600,000 users on Chrome, 36,459 users on Edge)
- Urban Browser Guard (40,000 users on Chrome, 12,624 users on Edge)
- Urban Ad Blocker (10,000 users on Chrome, 6,476 users on Edge)
Conflicting Messages
The extensions come with conflicting messages about how they handle bot conversations. For example, the Urban VPN Proxy in the Chrome Web Store lists "AI protection" as a benefit, but the extension actually collects and shares AI conversations with third parties.
Conclusion
The discovery of these extensions’ data collection practices is a serious invasion of electronic privacy. Users who have installed these extensions should assume that their conversations are now on the extensions’ servers and have been shared with third parties. It is essential to read the fine print and understand what data is being collected and how it is being used.
FAQs
- Q: What data is being collected by the extensions?
A: The extensions collect every prompt a user sends to the AI, every response received, conversation identifiers and timestamps, session metadata, and the specific AI platform and model used. - Q: How can I stop the data collection?
A: The only way to stop the harvesting is to disable the extension in the browser settings or to uninstall it. - Q: Which extensions are affected?
A: The affected extensions are Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker, available on both Chrome and Edge. - Q: What should I do if I have installed one of these extensions?
A: You should assume that your conversations are now on the extensions’ servers and have been shared with third parties. Consider uninstalling the extension and being more cautious when installing new extensions in the future.
