{"schema_version":"0.10.0","id":"LR-2026-0448","record_version":1,"title":"Malicious AI assistant extensions harvest LLM chat histories","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Microsoft's own report","original_document":{"url":"https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/","organisation":"Microsoft","role":"company"},"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"Microsoft's own report"}]},"sources_hash":"fb4c210aeb7a613dd81d94e60e84413210fd7abbb034169bfb2fb7ff09074249"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-05","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A Chromium browser extension that impersonated legitimate AI assistant tools collected visited URLs and AI chat content, including prompts and responses from ChatGPT and DeepSeek, and sent it to external servers. Reporting indicates the extensions reached approximately 900,000 installs, and Microsoft Defender telemetry confirmed activity across more than 20,000 enterprise tenants. The extension ran a background script that logged nearly all visited URLs and excerpts of AI chat messages, stored them locally and uploaded them periodically over HTTPS POST. Updates re-enabled telemetry after users had declined it. The exposure created potential leakage of proprietary code and confidential data. Microsoft published detections and hunting queries so defenders could find the extensions and their endpoints.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04","secondary_risks":["RK06","RK15"],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["H2"],"quote":"Leverage Microsoft Purview data security to implement AI data security and compliance controls around sensitive data being used in browser-based AI chat applications.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: many third parties (a stated count of two or more affected parties). Fact: Microsoft Defender telemetry confirms activity across more than 20,000 enterprise tenants.","harm_class":["privacy"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":["full URLs","navigation context","chat snippets","model names","persistent UUID"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/","publisher":"Microsoft","date":"2026-03-05","type":"press","title":"Malicious AI Assistant Extensions Harvest LLM Chat Histories - Microsoft","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.responsible_party":"C","event.adversarial_actor":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.responsible_party":[{"source_index":0,"quote":"The threat actor developed a Chromium-based browser extension compatible with both Google Chrome and Microsoft Edge."}],"event.adversarial_actor":[{"source_index":0,"quote":"The threat actor targeted the rapidly growing ecosystem of AI-assistant browser extensions and the user behaviors surrounding them."}],"impact.harm_class":[{"source_index":0,"quote":"The extensions collected full URLs and AI chat content from platforms such as ChatGPT and DeepSeek, exposing organizations to potential leakage of proprietary code, internal workflows, strategic discussions, and other confidential data."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Collected data includes full URLs (including internal sites), previous and next navigation context, chat snippets, model names, and a persistent UUID."}],"event.incident_class":[{"source_index":0,"quote":"The extensions collected full URLs and AI chat content from platforms such as ChatGPT and DeepSeek, exposing organizations to potential leakage of proprietary code, internal workflows, strategic discussions, and other confidential data."}],"impact.severity":[{"source_index":0,"quote":"Microsoft Defender telemetry also confirms activity across more than 20,000 enterprise tenants, where users frequently interact with AI tools using sensitive inputs."}],"impact.severity_because":[{"source_index":0,"quote":"Microsoft Defender telemetry also confirms activity across more than 20,000 enterprise tenants, where users frequently interact with AI tools using sensitive inputs."}],"event.remediations":[{"source_index":0,"quote":"Leverage Microsoft Purview data security to implement AI data security and compliance controls around sensitive data being used in browser-based AI chat applications."}],"event.summary":[{"source_index":0,"quote":"The extensions collected full URLs and AI chat content from platforms such as ChatGPT and DeepSeek, exposing organizations to potential leakage of proprietary code, internal workflows, strategic discussions, and other confidential data."},{"source_index":0,"quote":"Reporting indicates these extensions have reached approximately 900,000 installs."},{"source_index":0,"quote":"Microsoft Defender telemetry also confirms activity across more than 20,000 enterprise tenants, where users frequently interact with AI tools using sensitive inputs."},{"source_index":0,"quote":"The extension runs a background script that logs nearly all visited URLs and excerpts of AI chat messages."},{"source_index":0,"quote":"The data is stored locally in Base64-encoded JSON and periodically uploaded to remote endpoints, including deepaichats[.]com."},{"source_index":0,"quote":"Although users could initially disable data collection, subsequent updates automatically re-enabled telemetry, restoring data access without clear user awareness."},{"source_index":0,"quote":"Microsoft Defender customers can refer to the list of applicable detections below."}]},"notes_on_gaps":"Only one source (Microsoft Defender press blog, dated 2026-03-05 in its header) covers this incident; no government or implicated-party report was provided. The malicious extensions are browser extensions, not an autonomous AI agent, so agent_involved, failure_class and secondary classes are left out; the source mentions agentic browsers auto-downloading the extensions but does not describe an agent causing the incident. Date of occurrence, duration, time to contain, and root cause are not stated; no root cause was recorded because the source does not name a failed component beyond permissive extension policies. Trigger is not stated and was left out. The detection method was judged third_party because Microsoft Defender telemetry is a vendor source and the source uses the word reports; this is a judgement. The install count (approximately 900,000) and tenant count (more than 20,000) are stated approximately or as lower bounds, so no integer counts were recorded; third_parties_affected_count and records_exposed are left out. Direct loss, remediation hours, and records exposed are not stated. The developer and threat actor are unidentified. Industry and country are not stated. The system fields are left out because no AI model or product is described as the malicious system. The publication date is taken from the source header and the timeline order of the extension events is from the source narrative. Severity major follows the stated count of more than 20,000 enterprise tenants. Remediations are advice from the vendor, not fixes reported by an affected party, and no control is recorded as held in this incident. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (Microsoft's own report)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Users who had declined data collection found that later updates re-enabled telemetry without clear awareness.","quote":"Although users could initially disable data collection, subsequent updates automatically re-enabled telemetry, restoring data access without clear user awareness.","source_index":0,"grade":"C"},{"step":"reached","text":"Reporting indicates the extensions reached approximately 900,000 installs.","quote":"Reporting indicates these extensions have reached approximately 900,000 installs.","source_index":0,"grade":"C"},{"step":"caught","text":"Microsoft Defender telemetry confirmed activity across more than 20,000 enterprise tenants.","quote":"Microsoft Defender telemetry also confirms activity across more than 20,000 enterprise tenants, where users frequently interact with AI tools using sensitive inputs.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/"]},"analysis":{"sections":{"timeline":[{"text":"After installation the extension reloaded automatically each time the browser started.","quote":"Once installed, the extension automatically reloaded whenever the browser started, requiring no elevated privileges or additional user actions.","source_index":0,"when":null},{"text":"Following installation the extension began collecting data without further user interaction.","quote":"Following installation, the extension leveraged the Chromium extension permission model to begin collecting data without further user interaction.","source_index":0,"when":null},{"text":"Subsequent updates re-enabled telemetry for users who had declined it.","quote":"Although users could initially disable data collection, subsequent updates automatically re-enabled telemetry, restoring data access without clear user awareness.","source_index":0,"when":null},{"text":"After each transmission the local buffers were cleared.","quote":"After transmission, local buffers were cleared, reducing on-disk artifacts and limiting local forensic visibility.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/"]}}