Privacy & Security

An AI Browser Extension May Be Reading Your Private Chats

By Marcus Delgado / October 15, 2026 / Updated November 8, 2026

Laptop displaying the ChatGPT introduction page in a web browser

Quick answer: Yes, this one is real. Around the turn of 2026, researchers reported two Chrome extensions posing as AI sidebars, with about 900,000 users between them, that were sending people’s ChatGPT and DeepSeek conversations and open-tab addresses to servers the attackers controlled. Microsoft later wrote up the same campaign. You cannot judge an extension by its name, download count or badge. Open your extensions list, remove what you do not use, limit the rest to the sites they need, and if the chats were from work, tell IT.

Key takeaways

The core story checks out: OX Security’s findings were reported on January 6, 2026, and Microsoft published its own analysis on March 5, 2026.
The extensions copied chat text and page addresses. Microsoft notes that AI chat histories often hold source code, customer data and credentials.
Counts vary by Microsoft page, so treat the numbers as “hundreds of thousands of installs, thousands of organizations.”
A store badge is not proof of safety. One of the two listings had carried a “Featured” badge.
Newer wrinkle: one removed extension came back to the Chrome Web Store, and as of August 2026 researchers said it was doing something else, not stealing chats.

What researchers and Microsoft found

The Hacker News, reporting on OX Security’s research, named two extensions: “Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI” (about 600,000 users) and “AI Sidebar with Deepseek, ChatGPT, Claude, and more” (about 300,000). Every 30 minutes they reportedly sent chat content and the addresses of open tabs to attacker-run servers. One imitated a legitimate extension from AITOPIA. After installation they asked permission to gather “anonymous” usage data to improve the sidebar, which the researchers called misleading because the extensions went on to collect conversation content.

Microsoft’s Defender team described the same kind of extension on March 5, 2026. It said they logged visited addresses (including internal sites), snippets of AI chats, model names and a persistent ID, then sent them out in periodic HTTPS uploads. Microsoft reported activity across more than 20,000 enterprise tenants, about 900,000 installs, and said later updates switched data collection back on by default without clear notice. Because Edge supports Chrome Web Store listings, one listing reached both browsers. Microsoft added that some agentic browsers reportedly installed the extensions without explicit user approval.

Microsoft’s Digital Defense Report 2026 page mentions the case too: one extension with over 600,000 installs, found in December 2025, affecting almost 10,000 organizations. That is a different cut of the numbers than the March post, and I could not reconcile them. The page also showed no publication date I could see, so I could not confirm the “October” date in the original article.

What has changed since the original story

The Hacker News said on January 6 that both extensions were still listed. According to SecurityWeek, Google later removed the sidebar one in January 2026. On August 11, 2026, SecurityWeek reported that Netskope Threat Labs had found it back on the Chrome Web Store. Recent builds no longer showed the chat-copying behavior. Instead, a newer version added code that opens an affiliate link whenever the extension updates and rewrites the uninstall survey link so removal still earns a referral. Netskope called that low-stakes but warned the same update channel could carry something worse later, reported it to Google and advised organizations to remove it.

I could not confirm whether it is still listed as of November 8, 2026, and I found no later official update.

Why a “helpful sidebar” can see so much

An extension allowed to run on the pages you visit can see what is on those pages, and an AI chat is just a page. Chrome’s own menu labels the permission “This can read and change site data.” That is why the access setting matters more than the extension’s marketing.

The Chrome Web Store’s Limited Use policy sets rules on paper. Extensions may use data only for their disclosed purpose, collecting browsing activity is allowed only for a prominently described user-facing feature, selling data or using it for personalized ads is banned, and human access is restricted. The policy is a promise, though, not a scanner. In this case the listings stayed up until researchers flagged them. Edge has its own add-on store and policies, which I did not review here.

Audit your extensions in Chrome and Edge

These steps come from Google’s and Microsoft’s help pages as of November 2026. We did not test them on live browsers, and menus change by version and by company policy.

Task	Chrome	Edge
Open the list	More (three dots), then Extensions, then Manage extensions	Extensions icon next to the address bar, then Manage extensions (or Settings and more, then Extensions)
Turn off without removing	Use the toggle on the extension	Turn off the toggle next to the extension
Check permissions and site access	Manage extensions, Details, then Permissions (site access and Allowed sites)	Manage extensions, Details, then Site access. Microsoft’s removal article does not cover post-install permissions, so use this path as described in its FAQ.
Limit where it runs	In Details choose On select, On specific sites or On all sites. Or use the toolbar puzzle icon, More, then “This can read and change site data.”	Under Site access choose On specific sites or On click, then enter the URLs. I did not verify an “On all sites” option in Microsoft’s docs.
Remove	Right-click the icon and choose Remove from Chrome, or use Remove in Manage extensions	Right-click the icon and choose Remove from Microsoft Edge, then Remove

A two-minute audit checklist

Open the list. For each item ask: do I remember adding this, and do I still use it?
Remove anything unfamiliar. Microsoft’s guidance for users is to review installed extensions and remove ones they do not recognize.
Look for the two names above and for lookalikes. Copying a legitimate extension’s branding was part of this campaign.
For extensions you keep, switch site access to click-only or specific sites where your browser offers it.
Read the store listing’s developer and privacy details. SecurityWeek reported that this listing named the wrong developer.
Skip third-party AI sidebars if the AI service’s own site or app does the job.
Do not paste secrets into any chat you would not want leaving your browser.

If you think a work chat was exposed

Removing the extension stops further collection, but it cannot pull back what was already sent. Tell your IT or security team what the chats contained, such as code, customer details or passwords, and ask whether credentials should be changed. For organizations, Microsoft recommends inventorying and restricting extensions, turning on SmartScreen and Network Protection, and setting clear policies for AI use.

Frequently asked questions

Is a “Featured” badge or big download count a safety guarantee?

No. The Hacker News noted that the badge is not a guarantee, and the two listings had roughly 600,000 and 300,000 users.

Does this affect Edge users?

Possibly. Microsoft says Edge supports Chrome Web Store listings, so one listing could reach both browsers. Check your Edge list too.

Could an extension have been added without me noticing?

Microsoft’s write-up says some agentic browsers reportedly installed these extensions without explicit user approval. If you use one, check the list even if you do not remember installing anything.

Does uninstalling delete what was already collected?

No. Anything already uploaded sits on someone else’s server. That is why reporting matters for work chats.

Before you decide

You do not need to swear off every extension. You need to know what you have, what each one can read, and whether it earns that access. Treat chat sidebars with extra suspicion, because the thing they sit next to is often the most candid text you type all day.