Browser Extension Harvests 8M Users' AI Chatbot Data

Researchers at Koi Security have found that Urban VPN Proxy, a Chrome and Edge extension, harvests data from conversations with eight AI chatbots including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok (xAI) and Meta AI. The harvesting affects about 8 million users in total, with around 6 million on Chrome and hundreds of thousands on other Urban VPN products such as 1ClickVPN Proxy, Urban Browser Guard and Urban Ad Blocker.

The extension’s data collection operates independently of the VPN function and runs in the background without a user-facing toggle to disable it, according to Idan Dardikman of Koi Security. It injects a script into pages to override fetch and XMLHttpRequest, then packages and exfiltrates the raw API traffic to Urban VPN’s servers, including analytics.

Urban VPN’s publisher Urban Cyber Security Inc., affiliated with BiScience, is noted as disclosing some chatbot processing during setup, but full consent for harvesting is described as buried in a privacy form, according to the researchers. 16 December 2025.