{
 "public_id": "AIR-2025-0071",
 "incident_id": "2025-07-urban-vpn-extension-ai-conversation-harvesting",
 "date_disclosed": "2025-07-31",
 "date_occurred": "2025-07-09",
 "title": "Urban VPN Proxy pushed a silent update that intercepted and sold users' private ChatGPT, Claude, Gemini and Grok conversations",
 "class": "in_the_wild",
 "attack_surface": "browser_agent",
 "initial_vector": "malicious_extension_update",
 "agent_capability_abused": [
  "dom_access",
  "script_injection",
  "network_api_hooking",
  "background_exfiltration"
 ],
 "target_product": "Urban VPN Proxy browser extension",
 "target_vendor": "Urban Cyber Security / BIScience",
 "autonomy_level": "fully_autonomous",
 "impact_realized": true,
 "impact_type": [
  "privacy_violation",
  "data_exfiltration"
 ],
 "blast_radius": "over 6 million Chrome installs plus 1.3 million on Edge, and sibling extensions 1ClickVPN Proxy, Urban Browser Guard and Urban Ad Blocker doing the same",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI04",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "silent_update",
   "supply_chain",
   "no_opt_out",
   "data_broker",
   "conversation_interception",
   "featured_badge",
   "high_install_base"
  ]
 },
 "defense_present": "Chrome Web Store manual review (the extension held a Featured badge)",
 "defense_bypassed": true,
 "fix_shipped": "undisclosed at disclosure",
 "primary_sources": [
  "https://www.techradar.com/pro/security/this-google-chrome-extension-has-been-silently-stealing-every-ai-prompt-its-users-enter",
  "https://incidentdatabase.ai/cite/1356"
 ],
 "verified_quote": "Anything users typed into ChatGPT, Anthropic Claude, Microsoft Copilot, DeepSeek, Google Gemini, Grok, Meta AI, and Perplexity, would be picked up, as well as anything these tools returned.",
 "confidence": "high",
 "notes": "Disclosed by Koi Security. The mechanism is per-platform script injection that overrides fetch() and XMLHttpRequest so every request and response passes through the extension first, running whether or not the VPN is connected; Koi found the only remedy is uninstalling. Severity comes from the target — chat transcripts hold health, financial and personal material users share with nothing else — and from the extension having passed Google's manual review with a Featured badge. AI Incident Database incident 1356.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "PII Leakage",
 "risk_sub_secondary": [],
 "risk_override_reason": "7.3M users' private AI conversations were intercepted and sold to data brokers; the harm is surveillance of people, not compromise of a system",
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "a malicious browser extension harvested the AI conversations",
 "vector_family": "malicious_component",
 "vector_detail": "malicious_extension_update",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1356
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI04",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "sensitive_data_exposure",
 "eai_domain": "privacy",
 "eai_secondary": [
  "data_exfiltration_channels",
  "supply_chain_vulnerabilities"
 ],
 "eai_reason": "subcategory: PII Leakage",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI04 (vector_family=malicious_component); ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}