You know that generative AI browser assistant extension is probably beaming everything to the cloud, right?

Researchers from multiple universities audited 10 generative AI Chrome extensions and found widespread collection and sharing of sensitive data—including full HTML DOMs, form inputs (e.g., SSNs), and user prompts—with both first-party servers and third-party trackers, potentially running afoul of regulations like HIPAA and FERPA. Extensions such as Harpa, MaxAI, and Merlin were flagged as among the most invasive, while Perplexity was comparatively more privacy-friendly; practices observed included storing context across navigation, collecting full page content, and sharing referrers with trackers. The study calls for stricter Chrome Web Store vetting and embedding privacy-by-design, noting most assistants rely on server-side processing and can operate without explicit user interaction.