Urban VPN Chrome Extension Secretly Harvests Millions of AI Chatbot Conversations

Thumbnail Image

The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.

The Urban VPN Proxy Chrome extension, installed by over 6 million users and endorsed by Google, was found secretly intercepting and selling private conversations from major AI chatbots like ChatGPT, Claude, and Gemini. This large-scale privacy breach exposed sensitive user data without consent, violating fundamental privacy rights.[AI generated]

Why's our monitor labelling this an incident or hazard?

The event involves AI systems (ChatGPT, Gemini, Claude, etc.) whose user interactions are intercepted by malicious or deceptive browser extensions. These extensions collect and sell sensitive AI chat data without meaningful user consent, constituting a violation of privacy rights and data protection laws. This is a direct harm caused by the misuse of AI-related data and the extensions' design, fulfilling the criteria for an AI Incident under violations of human rights and legal obligations. The harm is realized, not just potential, as data has been harvested and sold for profit.[AI generated]
AI principles
AccountabilityPrivacy & data governanceRespect of human rightsTransparency & explainabilityRobustness & digital security

Industries
Digital security

Affected stakeholders
Consumers

Harm types
Human or fundamental rights

In other databases

Articles about this incident or hazard