Security researchers discovered that popular VPN extensions secretly capture and sell users’ chat data with AI platforms like ChatGPT, Claude, and Gemini. What’s marketed as ‘privacy tools’ are actually the exact opposite.

8 Million Users Affected

The investigation uncovered eight extensions sharing identical data harvesting code. Urban VPN Proxy leads the pack with over 6 million Chrome users alone.

Urban VPN Proxy Chrome Extension

The extension carries Google’s “Featured” badge and maintains a 4.7-star rating from 58,500 reviews. But right on cue after this AI data theft research was published by Koi, an influx of negative reviews have started to pour in.

Other affected extensions include 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker. Combined across Chrome and Edge browsers, more than 8 million users have unknowingly shared their private AI conversations.

What Data Gets Stolen?

The extensions target major AI platforms including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI.

Everything you share with these AI assistants gets collected. Medical questions, financial details, work projects, personal problems – all captured and sold to advertisers.

The harvesting runs continuously in the background whether the VPN is connected or not. There’s no way to disable it through settings.

The data theft started in version 5.5.0, released on July 9, 2025. Anyone who used these extensions after that date should assume their conversations are compromised.

How It Works

When you visit targeted AI platforms, the extension injects scripts into the webpage. These scripts override your browser’s core functions to intercept all traffic between you and the AI service.

Every prompt you send, every response you receive, timestamps, and session details get captured and sent to Urban VPN’s servers.

Urban VPN is operated by Urban Cyber Security Inc., which connects to BiScience, a known data broker company. According to the research, this stolen information is sold for “marketing analytics purposes.”

Even a simple question to Google Gemini about Urban VPN’s privacy policy came back with the answer we expected.

Google’s Failure

Urban VPN Proxy earned Google’s Featured badge, meaning a human reviewer examined and approved it. The Chrome Web Store’s policies explicitly prohibit selling user data to data brokers.

Yet these free VPNs and extensions remained live with Featured badges for months while actively harvesting user data.

And worse yet if you read Google Play’s Privacy section about Urban VPN, the developer is lying about user data.

Final Thoughts

If you have Urban VPN Proxy, 1ClickVPN Proxy, Urban Browser Guard, or Urban Ad Blocker installed, remove them immediately.

Any AI conversations since July 2025 should be considered compromised. This incident exposes how browser extensions can exploit user trust while platform reviews fail to catch harmful behavior.

Free VPN services continue proving the old saying true: if you’re not paying for the product, you are the product.

For more details on this story, refer to the original findings from Koi.

We want to know your thoughts. What do you think about this story? Let us know in the comment section below!

Be sure to stay up-to-date with the latest streaming news, reviews, tips, and more by following the TROYPOINT Advisor with updates weekly.