Malicious Chrome Extension Secretly Steals AI Chats From 100K Users, Report Finds

A Chrome extension marketed as a productivity tool for AI users has been caught siphoning private conversations from ChatGPT, Claude, Gemini, Perplexity, and six other AI platforms without requiring users to open the extension, click a button, or take any action beyond installing it.

Security researcher Jean-Marie R. (known online as Toborrm9) published findings on malext.io on July 26, 2026, detailing how “Prompt Optimizer – SecondBrain,” a Chrome extension with roughly 100,000 users, quietly captures and uploads full prompt-and-reply exchanges to servers controlled by its developer, SecondBrain (secondbrain[.]is).

The extension’s stated function of rewriting user prompts for better AI results genuinely works. But it runs alongside a separate, undisclosed data-collection pipeline that operates independently of any user interaction.

Malicious Chrome Extension Secretly Steals AI Chats

The extension installs a background worker that immediately forces three internal settings: consent to “agreed,” data collection to “on,” and data protection to “off.” These values are rewritten every time the user visits any website, because the extension’s tab-monitoring listener has no URL filter, so simply browsing the web keeps the collection pipeline active.

The actual capture engine hides inside a file misleadingly named chatgpt_context_fetch_diagnostics.js. Despite the name, it isn’t diagnostic and isn’t limited to ChatGPT.

It overrides core browser networking functions fetch, XMLHttpRequest, and WebSocket across nine AI services, intercepting both outgoing prompts and incoming AI responses in real time. Where network interception falls short, MutationObservers scrape reply text directly from the page, and in Meta AI’s case, capture keystrokes as they’re typed.

Notably, the extension also parses Microsoft’s SignalR protocol frames to pull data from enterprise Copilot deployments (copilot.cloud.microsoft), meaning organizations running Copilot internally could have tenant conversations leaked externally if this extension is permitted on managed devices.

Captured data is batched, compressed, and encrypted with AES-GCM before being sent to ingest.secondbrain.is. On paper, encryption sounds reassuring, but the encryption key itself is issued by SecondBrain’s own servers at installation, with no locally generated secret or user password involved.

In practice, this means SecondBrain holds the only key needed to decrypt every user’s data. Toborrm9 confirmed this by decrypting a live upload using the server-issued key, verifying an exact match.

The extension’s Chrome Web Store listing states the developer “will not collect or use your data.” Its privacy policy claims prompts are “stored only” locally and that no personal information is collected or shared with third parties. The store description says data is saved “directly in your browser.”

None of this matches the code. The extension writes “consent: agreed” before users see any prompt, and none of the interface’s toggles, including a leftover, unreachable consent screen, actually control data collection.

A hardcoded configuration file overrides any stored preference, and developer comments left in the code explain the protection gate was intentionally disabled to avoid “interfering with response streaming.”

Because prompts and AI replies routinely contain sensitive personal, business, or proprietary information, this isn’t a minor privacy lapse; it’s mass, covert interception of private communications at scale, dressed up as a productivity feature.

Toborrm9 also found a bundled third-party market-research SDK with obfuscated tracking identifiers, suggesting the collected data may feed into broader analytics or resale pipelines beyond SecondBrain itself.

Security teams are advised to block the extension via enterprise install policies (ID: aajjgdpofhhcjmjoombjdfepplndhgcp) and monitor for outbound traffic to secondbrain.is subdomains, particularly in environments using Microsoft 365 Copilot.