Your AI sidekick might be a spy.

Researchers discovered a coordinated campaign of 16 malicious browser extensions masquerading as ChatGPT productivity tools that intercepted and exfiltrated ChatGPT session authentication tokens to attacker-controlled servers, allowing adversaries to impersonate users and access conversations and linked services (e.g., Google Drive, Slack); the findings emphasize the emerging attack surface posed by AI-focused browser extensions and the need to monitor and restrict third-party AI tools.