Particle.news
Download on the App Store
9 ARTICLES
·
yesterday

Urban VPN Browser Extensions Caught Harvesting AI Chats From Millions of Users

Researchers detail a July auto‑update that injected scripts overriding network APIs to capture full AI conversations for transmission to Urban VPN analytics linked to a data broker.

Image
Image
Person typing on a laptop in a low lit room
Image

Overview

  • Koi Security identified Urban VPN Proxy and related extensions 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker collecting chatbot prompts and responses across Chrome and Edge.
  • The extensions target ten AI platforms, including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI.
  • Executor scripts injected into AI sites override fetch() and XMLHttpRequest to intercept data and exfiltrate it to analytics.urban-vpn.com and stats.urban-vpn.com.
  • Urban VPN’s policy discloses sharing “web browsing data,” including AI inputs and outputs, with affiliated firm BiScience for marketing analytics, echoing earlier concerns over clickstream collection.
  • Koi attributes the behavior to version 5.5.0 released on July 9, 2025, notes no user-facing opt-out, advises uninstalling, and reports the extensions remain listed with Featured badges as platform responses are pending.