Chrome extensions spying on your ChatGPT convos

Happy Friday and Happy New Year

In a recent episode of our Cyber Secured podcast series (Hawaii's #1 Cybersecurity Podcast - available on every major podcasting platform), Matt and I go into depth about the dangers of using browser extensions.

Extensions act like an app for your browser, doing things like like storing passwords, blocking ads, filling in coupon codes, etc. This week OX Security found Chrome extensions stealing ChatGPT conversations from almost 1 million computers.

And this is not the first time this has happened. A few weeks ago Urban VPN Proxy, another extension with millions of installations on Google Chrome and Microsoft Edge was caught spying on AI chat conversations.

It's getting bad, so of course now it has a name: Prompt Poaching, where a browser extension secretly reads and captures your AI conversations.

The Takeaway

Considering how often most of us use AI, I'm sure you don't want this kind of spying happening to you. Here's what I suggest:

1) Be careful what you type into AI tools

Treat AI conversations like email or chat and assume they could be seen by someone else. Avoid pasting passwords, client details, internal documents or anything you would not want exposed.

2) Clean up your browser extensions

Many extensions can read what is on web pages, including AI conversations. Remove anything you do not actively use and be especially cautious of "free" productivity or AI add-ons with broad permissions. Remember, if it's free, then you are the product.

3) Use a separate browser profile for AI work

Keep AI tools in a dedicated browser or profile with no unnecessary extensions installed. This separation significantly reduces the risk of your conversations being silently observed or collected.

We can only fight cybercrime if we use common sense and work together.

Stay safe out there.

-Attila

PS. We did a segment this week on Hawaii News Now about

protecting your money from cyber criminals. Check it out on YouTube