AI Risk Wire

Cases › leaked private data › LR-2026-0359

Urban VPN Proxy Chrome extension harvested AI chat conversations

Confirmed Why: remio's own report · remio · 3 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major
Reported 16 Dec 2025

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Urban VPN Proxy, a free Chrome extension with over 6 million installs, was reported to have collected conversations users held with major AI assistants, including ChatGPT, Claude and Gemini. According to the investigation by Koi, starting with version 5.5.0 released on July 9, 2025, the extension intercepted prompts and responses by overriding browser APIs and sent them to the publisher's servers, even when the VPN was turned off. The harvested data was later shared with BiScience, an affiliated data broker. The discovery came after Koi's analysis of browser extensions for hidden data exfiltration. Koi found the same scripts in related extensions, which together affected more than 8 million users. Google's review system did not detect the behaviour. As of December 19, the extension had been removed from the Google app store.

What happened

1 · What it was doingThe extension, which users installed as a free VPN, intercepted AI assistant conversations from version 5.5.0 onward, including when the VPN was off.
2 · What it reached or didThe harvested data was later shared with BiScience, an affiliated data broker.

What was done

No source states an action or fix.

Risks

Data leaked or sent out
Primary32 incidents
Privacy harm to a person
Also41 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Evidence

No source states: what went wrong, how it was caught, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 1 items from the primary sources

What happened, in order

  1. 2025-07-09 Version 5.5.0 released and the extension began intercepting AI assistant conversations, even with the VPN off.
Show every field, with its source and grade

The AI system

What it was allowed to do
read and change all your data on the websites you visit
C one secondary source states it

What happened

When it happened
2025-07-09
C one secondary source states it
Earliest source we hold
2025-12-16
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
What went wrong
leaked private data
C one secondary source states it
primary risk
RK04
D inferred by us from the described behaviour, reason shown
secondary risks
RK15
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
C one secondary source states it

LR-2026-0359 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON