Know which add-ons are installed
Inventory AI browser add-ons and explain why broad page-reading permissions need review.
What this does—and does not—establish
A familiar name or marketplace badge does not establish safe behavior.
AI as a targetCASE STUDY / Browser users; reported by OX Security and Microsoft
Browser add-ons copied private AI conversations
OX Security found two connected browser extensions sending ChatGPT and DeepSeek conversations to outsiders.
Source: OX SecurityDecember 30 is the first reviewed disclosure, not the attack’s start. Microsoft and Netskope later added findings.
THE 10-SECOND TAKEAWAY
A browser add-on can read what you share with AI.
HOW IT WORKED
Follow the chain.
AI sidebar
→
Browser permissions
→
Private pages
SIMPLIFIED VIEW · 1 / 3STEP 01
A useful-looking add-on
The extensions offered an AI sidebar while requesting broad access to web pages.
OX SecurityYour prompt
→
AI reply
→
Copied conversation
SIMPLIFIED VIEW · 2 / 3STEP 02
Private chats are copied
The add-ons read prompts and replies visible in ChatGPT and DeepSeek.
OX SecurityBrowser storage
→
Repeated transfers
→
Outside servers
SIMPLIFIED VIEW · 3 / 3STEP 03
The copies leave the browser
Microsoft found collected chats and browsing information being sent to outside servers at regular intervals.
Microsoft Defender Security Research TeamMove through the story at your own pace.
1 / 3
THINK OF IT THIS WAY
Editorial analogy: a helpful-looking assistant beside your notebook quietly photocopies the pages. The notebook’s publisher does not have to be hacked for its contents to escape.
An analogy for the mechanism; not an additional claim about the incident.KEEP THE EVIDENCE IN VIEW
What we know.
What we don’t.
Reported outcomes
OX connected two extensions with over 900,000 reported downloads. Downloads are not confirmed victims. OX Security
Microsoft detected related activity across more than 20,000 enterprise tenants. Microsoft Defender Security Research Team
Important limits
Tenant telemetry does not prove every organization lost the same data.
This does not establish a breach of OpenAI’s or DeepSeek’s servers.
Later sidebar versions changed behavior; they did not retain the earlier chat-theft code.
The lesson beyond
this one case.
Editorial lesson: private information can leave through software surrounding an AI chat. Review the add-ons allowed to read those conversations, as well as the AI service itself.
Where were the people?
People distributed the extensions; Microsoft also observed some agentic browsers downloading them automatically. Microsoft Defender Security Research Team
What happened in response? +
Netskope reports that Google removed one extension in January. It later returned with affiliate redirects; newer versions no longer contained chat-theft code. Netskope Threat Labs
What could help
an organization?
Editorial mapping of browser controls. These controls are relevant, not evidence that a particular product would have prevented this campaign.
Review extensions and their updates
Allow approved extensions and reassess changes in permissions or behavior after updates.
What this does—and does not—establish
An earlier clean version does not establish that future versions remain safe.
Investigate where browser data goes
Monitor unusual outbound transfers and determine which conversations or other data may have left.
What this does—and does not—establish
Blocking future transfers cannot recover data already copied.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkTRACE IT TO THE SOURCE
Read the evidence.
Explore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01900K Users Compromised: Chrome Extensions Steal ChatGPT and DeepSeek ConversationsOX Security · Dec 30, 2025 · primary researcher investigation
02Malicious AI Assistant Extensions Harvest LLM Chat HistoriesMicrosoft Defender Security Research Team · Mar 5, 2026 · primary researcher investigation
03AI Sidebar Extension Monetizes Its Own UpdatesNetskope Threat Labs · Aug 11, 2026 · primary researcher investigation
Read this case’s update history →
Reviewed Oct 1, 2026 · Editorial methodology · Structured data