Urban VPN Proxy Browser Extension Reportedly Harvested and Sold Private AI Chatbot Conversations via Silent Update

Security researchers reported that the Urban VPN Proxy browser extension introduced AI conversation–harvesting functionality in version 5.5.0, released July 9, 2025. The extension allegedly intercepted and exfiltrated private conversations from AI platforms including ChatGPT, Claude, Gemini, Grok, and others without a user-facing opt-out. The data, including sensitive personal and financial information, was reportedly shared with affiliated data brokers for commercial analytics.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The browser extensions silently harvested and exfiltrated highly sensitive, non-public personal conversations from AI platforms, directly compromising user privacy.

Additional risk subdomains

• 5.1 Overreliance and unsafe use: The incident highlights how users' deep trust and candor with AI assistants led them to share highly sensitive personal details, making the exfiltration of these conversations exceptionally damaging.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The data harvesting was caused by the intentional decision of the extension developers to inject scraping scripts into users' browsers post-deployment of the AI systems.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Risk Level 3: Limited Risk. The report describes users interacting with chatbots such as ChatGPT, Claude, and Gemini, which are explicitly categorized as Limited Risk systems requiring transparency under the EU AI Act.

AI system and alleged parties

• AI system: Urban VPN Proxy 5.5.0
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: Urban Cyber Security Inc., BiScience
• Alleged deployer: Urban Cyber Security Inc.
• Alleged harmed parties: Urban VPN Proxy users, Perplexity users, Meta AI users, Grok users, General public, Gemini users, DeepSeek users, Copilot users, Claude users, ChatGPT users, Chatbot users, Browser extension users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Severe. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Severe, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Severe, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report describes massive privacy violations, which represent an abuse of the fundamental right to privacy for over 8 million users.

Privacy

Reported: The report explicitly describes massive privacy violations where private conversations containing medical, financial, and proprietary data were silently harvested and exfiltrated.

Directly caused: The Urban VPN Proxy and related extensions silently harvested and exfiltrated the private AI conversations of over 8 million users, including prompts, responses, and metadata, and shared them with a data broker.

Inferred additional harm: It is highly likely that the exfiltrated data, once sold to third parties, will be used for targeted advertising, profiling, or potentially re-identified to compromise individual users' privacy further.

People affected

• Occurrences reported: 1
• People reportedly harmed: 8000000
• People reportedly exposed: 8000000

Potential causes

Management

• Monetization Prioritized Over Safety: Urban Cyber Security monetized user data by sharing it with BiScience.
• Deceptive Marketing of AI Protection: Management framed data harvesting as an 'AI protection' security feature.
• Lack of Corporate Ethical Standards: Management knowingly updated privacy policies to exploit sensitive user chats.

Technology

• Script Injection Overriding Fetch API: Injected scripts override fetch/XHR to intercept AI prompts and responses.
• Lack of User-Facing Toggle: Users cannot disable AI harvesting without completely uninstalling the extension.
• Silent Background Execution: Data harvesting runs continuously even when the VPN is disconnected.

Data Inputs

• Harvesting of Sensitive AI Prompts: User prompts containing medical, financial, and proprietary data are captured.
• Interception of AI Chat Responses: AI-generated outputs are exfiltrated along with the user's input queries.
• Collection of Session Metadata: Conversation IDs, timestamps, and model details are gathered and exfiltrated.

Human Factors

• Overreliance on Featured Badges: Users trusted the extension because of Google's 'Featured' endorsement.
• Uninformed Consent and Dark Patterns: The consent prompt framed AI monitoring as a protective safety feature.
• High Candor with AI Chatbots: Users share highly sensitive personal details with AI, assuming privacy.

Process and Methods

• Inadequate Extension Store Review: Google and Microsoft manual reviews failed to flag the harvesting code.
• Silent Extension Auto-Updates: The harvesting code was pushed silently to existing users via auto-updates.
• Contradictory Store Declarations: Store listings claimed no third-party data sales, contradicting the policy.

Regulatory Environment

• Weak Extension Store Enforcement: Stores failed to enforce policies against selling data to data brokers.
• Lack of AI Data Privacy Laws: Absence of strong regulations preventing third-party scraping of AI chats.
• Permissive Data Broker Oversight: Data brokers operate with minimal oversight regarding harvested AI data.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide highly detailed technical analysis of the exfiltration mechanism, including specific script names, API overrides, and data destinations. The scale of the incident (over 8 million users) and the specific extensions involved are clearly documented by security researchers, with corroborating coverage from multiple tech news outlets.
• Ambiguities identified: There is minor ambiguity regarding the exact volume of conversations successfully sold to third parties and whether any specific individuals have already suffered financial fraud or identity theft as a direct result of the leak.
• Alternative interpretations: None. The technical evidence of silent data harvesting is clear and uncontested.

A massive data harvesting campaign by Urban Cyber Security Inc. used browser extensions to silently exfiltrate private AI conversations from over 8 million users. While constituting a severe privacy violation and exposing proprietary code and personal data to data brokers, the incident represents a minor national security threat primarily managed through standard cybersecurity and privacy regulations.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Multiple nations
• Alleged perpetrator: Urban Cyber Security Inc.

Threat characteristics

• Imminence: Long-term. Represents an ongoing data exposure and privacy concern rather than an active, immediate tactical crisis.
• Autonomy: Human-controlled. The data exfiltration was executed via developer-written scripts injected into the browser, not by an autonomous AI decision-making agent.
• Novelty: Evolved capability. While extension-based data scraping is an established threat, targeting and exfiltrating specific conversational AI inputs and outputs represents an evolved capability.

Impact by dimension

• Physical security: Negligible. No threats to physical infrastructure, kinetic systems, or human safety were reported in this incident.
• Information security: Minor. Commercial harvesting of private AI conversations, including proprietary code and professional data, poses a minor intelligence risk through potential exposure of sensitive intellectual property.
• Sovereignty: Negligible. There is no evidence of disruption to government decision-making, electoral systems, or core state authority.
• Economic security: Minor. Exfiltration of proprietary code and financial details of users presents minor risks to economic and technological security through potential intellectual property exposure.
• Societal stability: Minor. Large-scale privacy violation compromising personal data of over 8 million users, though currently limited to commercial exploitation rather than state-level systematic oppression.