VPN extension stole ChatGPT, Gemini chats from 6M users
A popular "privacy" tool with over 6 million users has been secretly harvesting and selling private AI conversations to data brokers for nearly six months, according to security researchers at Koi who published their findings on December 14.
Urban VPN Proxy, a Google Chrome extension carrying the platform's coveted "Featured" badge, has been intercepting every conversation users have with ChatGPT, Gemini, Claude, and six other major AI platforms since July 2025. The extension, operated by Urban Cyber Security Inc. and affiliated with data broker BiScience, sells the collected conversations—including medical questions, financial details, and proprietary code—to third parties for "marketing analytics purposes".
Urban VPN Proxy, a Chrome extension with over 8 million users, has been discovered to harvest and sell users' AI conversations from platforms like ChatGPT and Gemini. Despite its 'Featured' badge and claims of privacy protection, the extension silently collects users' prompts, responses, and other data, which it then sells to third parties for marketing analytics. This behavior contradicts Google's policies on data transfer and highlights a significant security lapse in browser extension reviews.
6 Comments