The Urban VPN Proxy Chrome extension, widely downloaded and promoted as a free VPN protecting user privacy, has been found to covertly harvest AI chatbot data entered by its users. Following a July 2025 update, the extension began collecting not only user prompts but also AI responses and related metadata from popular AI chatbots such as ChatGPT, Claude, Gemini, Microsoft Copilot, and others. This data is then sent to BIScience, an ad analytics company, for processing.
Despite Urban VPN Proxy’s claims of enhancing privacy with features like “AI protection,” which supposedly scans prompts for personal data and warns users about unsafe content, the data collection continues even after users disable the VPN or AI protection feature. The extension injects scripts that monitor users’ AI interactions continuously, a fact that is obscured within dense privacy statements, leaving most users unaware their sensitive chatbot conversations are being harvested.
This extension had amassed around 6 million users on the Chrome Web Store, where it even carried a “Featured” badge, indicating official endorsement despite its intrusive behavior. Similar data-harvesting patterns have also been noted in related browser extensions under the same developer umbrella. This incident highlights growing concerns over privacy risks posed by third-party browser tools, especially those interacting with AI services, and underscores the need for vigilant scrutiny of extensions promising privacy while engaging in undisclosed data monetization.
