\n
![](\"https:\/\/cdn.arstechnica.net\/wp-content\/uploads\/2025\/12\/electronic-privacy-invasion-1152x648.jpg\")
<\/p>\n
\n<\/p>\n
Browser extensions with greater than 8 million installs are harvesting customers\u2019 full and prolonged AI conversations and promoting them for advertising functions, in response to information collected from the Google and Microsoft pages internet hosting them.<\/p>\n
Safety agency Koi found<\/a> the eight extensions, which as of late Tuesday evening remained out there in each Google\u2019s and Microsoft\u2019s extension shops. Seven of them carry \u201cFeatured\u201d badges, that are endorsements meant to sign that the businesses have decided the extensions meet their high quality requirements. The free extensions present features equivalent to VPN routing to safeguard on-line privateness and advert blocking for ad-free searching. All present assurances that consumer information stays nameless and isn\u2019t shared for functions apart from their described use.<\/p>\n An examination of the extensions\u2019 underlying code tells a way more difficult story. Every comprises eight of what Koi calls \u201cexecutor\u201d scripts, with every being distinctive for ChatGPT, Claude, Gemini, and 5 different main AI chat platforms. The scripts are injected into webpages any time the consumer visits one in every of these platforms. From there, the scripts override browsers\u2019 built-in features for making community requests and receiving responses.<\/p>\nA gold mine for entrepreneurs and information brokers<\/h2>\n