In the wild
Realized harm
Urban VPN Proxy pushed a silent update that intercepted and sold users' private ChatGPT, Claude, Gemini and Grok conversations
AIR-2025-0071 AIR record · 2025-07-urban-vpn-extension-ai-conversation-harvesting
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Anything users typed into ChatGPT, Anthropic Claude, Microsoft Copilot, DeepSeek, Google Gemini, Grok, Meta AI, and Perplexity, would be picked up, as well as anything these tools returned.techradar.com
The record
Disclosed
2025-07-31
Occurred
2025-07-09
Vendor
Urban Cyber Security / BIScience
Product
Urban VPN Proxy browser extension
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels, Supply chain vulnerabilities
System type
Generative model
Who acted
AI was the target — a malicious browser extension harvested the AI conversations
Attack surface
Browser agent
Autonomy level
Fully autonomous
Initial vector
Malicious extension update
Impact type
Privacy violation, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
over 6 million Chrome installs plus 1.3 million on Edge, and sibling extensions 1ClickVPN Proxy, Urban Browser Guard and Urban Ad Blocker doing the same
Capability abused
Defense & remediation
Recorded defense
Chrome Web Store manual review (the extension held a Featured badge)
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
undisclosed at disclosure
Taxonomy & references
Curator notes
Disclosed by Koi Security. The mechanism is per-platform script injection that overrides fetch() and XMLHttpRequest so every request and response passes through the extension first, running whether or not the VPN is connected; Koi found the only remedy is uninstalling. Severity comes from the target — chat transcripts hold health, financial and personal material users share with nothing else — and from the extension having passed Google's manual review with a Featured badge. AI Incident Database incident 1356.
Supporting sources
Cite as
Enkrypt AI. "Urban VPN Proxy pushed a silent update that intercepted and sold users' private ChatGPT, Claude, Gemini and Grok conversations". AIR, AIR-2025-0071. https://agentincident.vercel.app/i/AIR-2025-0071/ (accessed 2026-10-19).