Chrome Extensions Stealing Your AI Chats

Two malicious Chrome extensions with over 900,000 combined users were caught exfiltrating ChatGPT and DeepSeek conversations every 30 minutes. The extensions impersonated AITOPIA’s legitimate multi-AI chat sidebar, deceptively requesting consent for “anonymous analytics” while actually stealing complete chat content. This represents an escalating threat pattern dubbed “Prompt Poaching”, where both malicious and legitimate extensions intercept sensitive AI conversations for corporate espionage and data harvesting. John Tuckner of Secure Annex named the practice after finding that the Similarweb extension (1,000,000+ users) hooks fetch and XMLHttpRequest to read ChatGPT conversation streams, steered by a remote configuration that a store review of the extension code never sees. Ox Security’s analysis and a video breakdown have more details.