Browser Extension Harvests 8M Users' AI Chatbot Data

Researchers found that the Urban VPN Proxy browser extension (and several sibling extensions) injects executor scripts into pages for popular AI chatbots (ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, Meta AI) to override fetch() and XMLHttpRequest, capture prompts, responses, conversation IDs, timestamps and metadata, and exfiltrate that data to Urban VPN/BiScience endpoints; the capability is enabled by default in versions ≥5.5.0, impacts roughly 8 million users, and is effectively disclosed only in buried privacy text despite the extension marketing itself as a privacy tool.