AI Risk Wire

Cases › security breach › LR-2026-0448

Malicious AI assistant extensions harvest LLM chat histories

Confirmed Why: Microsoft's own report · Microsoft · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: advice only, no fix reported

Severity major
Reported 5 Mar 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: Test: many third parties (a stated count of two or more affected parties). Fact: Microsoft Defender telemetry confirms activity across more than 20,000 enterprise tenants.

A Chromium browser extension that impersonated legitimate AI assistant tools collected visited URLs and AI chat content, including prompts and responses from ChatGPT and DeepSeek, and sent it to external servers. Reporting indicates the extensions reached approximately 900,000 installs, and Microsoft Defender telemetry confirmed activity across more than 20,000 enterprise tenants. The extension ran a background script that logged nearly all visited URLs and excerpts of AI chat messages, stored them locally and uploaded them periodically over HTTPS POST. Updates re-enabled telemetry after users had declined it. The exposure created potential leakage of proprietary code and confidential data. Microsoft published detections and hunting queries so defenders could find the extensions and their endpoints.

What happened

1 · What went wrongUsers who had declined data collection found that later updates re-enabled telemetry without clear awareness.
2 · What it reached or didReporting indicates the extensions reached approximately 900,000 installs.
3 · How it was caughtMicrosoft Defender telemetry confirmed activity across more than 20,000 enterprise tenants.

What was done

Advice in source, not a fix by the party

“Leverage Microsoft Purview data security to implement AI data security and compliance controls around sensitive data being used in browser-based AI chat applications.”

Sensitive-data checks on outbound data

Risks

Data leaked or sent out
Primary32 incidents
Supply-chain compromise
Also24 incidents
Rising: 4 vs 0.2 a week
Privacy harm to a person
Also41 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Evidence

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 4 items from the primary sources

What happened, in order

Not dated in the sources:

  • After installation the extension reloaded automatically each time the browser started.
  • Following installation the extension began collecting data without further user interaction.
  • Subsequent updates re-enabled telemetry for users who had declined it.
  • After each transmission the local buffers were cleared.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-03-05
D inferred by us from the described behaviour, reason shown
Who was responsible
an outside party
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
primary risk
RK04
D inferred by us from the described behaviour, reason shown
secondary risks
RK06, RK15
D inferred by us from the described behaviour, reason shown
remediations
kind: advice; controls added: H2; quote: Leverage Microsoft Purview data security to implement AI data security and compliance controls around sensitive data being used in browser-based AI chat applications.; source index: 0
C one secondary source states it

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
C one secondary source states it
Kinds of data exposed
full URLs, navigation context, chat snippets, model names, persistent UUID
C one secondary source states it
Why this severity
Test: many third parties (a stated count of two or more affected parties). Fact: Microsoft Defender telemetry confirms activity across more than 20,000 enterprise tenants.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The system fields are left out because no AI model or product is described as the malicious system. The publication date is taken from the source header and the timeline order of the extension events is from the source narrative.

LR-2026-0448 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON