Some ChatGPT browser extensions are stealing your data

LayerX Research identified a campaign of 16 malicious Chrome extensions marketed as ChatGPT productivity tools that inject scripts to capture outbound requests from the ChatGPT web app and exfiltrate session tokens, authorization details, telemetry, and backend access tokens to attacker-controlled servers; with these tokens attackers can impersonate users, access chat histories and integrated services (e.g., Slack, GitHub). The extensions share code, branding, upload patterns and backend infrastructure, remain listed on the Chrome Web Store, and have low but nontrivial distribution (~900 downloads), prompting concern that wider adoption of AI extensions could amplify impact.