The privacy extension that sold your AI chats
People installed it to be safer online. It had Google’s Featured badge and 4.7 stars. Then an update quietly started collecting everything they said to ChatGPT, Claude and Gemini.
You want a bit more privacy, so you install a free VPN. It has thousands of good reviews and a badge from Google that says it’s recommended. You forget about it. Months later, you ask an AI about a lump you found, about your marriage, about money you owe.
That’s what happened to millions of people with Urban VPN Proxy. In December 2025, researchers at Koi Security found that the extension had been collecting conversations with eight AI services: ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok and Meta AI (Malwarebytes).
What happened
- The collecting started with an update on 9 July 2025 (version 5.5.0). Nobody had to click anything.
- More than six million people used it in Chrome and 1.3 million in Edge. Seven other extensions from the same company had the same code.
- The conversations went to BiScience, the company behind the extension, which Malwarebytes describes as a data broker.
A month later it happened again. Two fake “AI sidebar” extensions, copies of a real one, had more than 900,000 downloads. They sent full ChatGPT and DeepSeek conversations to their makers, together with the addresses of every open tab (SecurityWeek, January 2026).
Why this keeps happening
An extension that can read a web page can read what you type into an AI. That’s true for helpful tools and for harmful ones. A badge or a high rating says nothing about what the next update will do.
How to protect yourself
- Open your extensions page and remove what you don’t use. Be extra careful with free VPNs and “AI sidebars”.
- Look at what each extension may access. “Read and change all your data on all websites” includes your AI chats.
- Prefer extensions whose code is public, so anyone can check what they do.
And Kamelo?
Kamelo is an extension too, and it needs to read what you type in order to protect it. So you shouldn’t have to take our word for anything. That’s why every line of Kamelo is open source, and why it makes no network requests of its own: open your browser’s developer tools while you use an AI, and you’ll see nothing going to Kamelo. Releases are signed and only come from the official Chrome and Edge stores.
Trust should be something you can check. How Kamelo keeps your data safe.