8M Users' AI Conversations Sold for Profit by "Privacy" Extensions (www.koi.ai)

A recent investigation revealed that the Urban VPN Proxy Chrome extension, boasting over 8 million users, has been secretly harvesting AI conversations from prominent platforms like ChatGPT and Claude since July 2025. Despite its heavy marketing as a privacy and security tool, the extension operates an intrusive data collection system that intercepts and exfiltrates user conversations without explicit user consent or the ability to opt-out. This function is embedded within the extension's code, executing silently even when the VPN is inactive. This discovery raises significant privacy concerns for the AI/ML community, highlighting vulnerabilities in browser extensions that claim to enhance user security while engaging in dubious data practices. The technical mechanism involves script injections that allow the extension to monitor and capture every interaction users have with AI systems, including personal and sensitive information. Alarmingly, the captured data, including conversation contents and metadata, is sent to Urban VPN's servers and sold for marketing analytics, contrasting sharply with the promises made by the extension. The incident underscores the urgent need for tighter regulations and better user awareness regarding data privacy in AI applications and digital products.