Chrome Extension Spies on AI Conversations in ChatGPT, Claude, Gemini

Key Takeaways

• A Chrome extension, “Prompt Optimizer – SecondBrain,” with approximately 100,000 installations, is covertly collecting all user prompts and AI responses across nine prominent AI platforms.
• Despite explicit privacy claims of no personal data collection, the extension actively captures sensitive conversations from services like ChatGPT, Claude, Gemini, and even enterprise versions of Microsoft Copilot.
• The data is encrypted and exfiltrated to remote servers, but the encryption key is controlled by the extension provider, enabling decryption of all captured information.
• The extension poses significant data leakage risks, particularly for corporate environments utilizing AI tools, as it bypasses stated privacy settings and user controls.

Chrome Extension Covertly Exfiltrates AI Conversations

A widely used Chrome extension, “Prompt Optimizer – SecondBrain” (ID: aajjgdpofhhcjmjoombjdfepplndhgcp, version 2.3.1), with an estimated 100,000 users, has been identified as systematically harvesting every AI prompt and response across a spectrum of leading artificial intelligence platforms. This activity occurs despite the extension’s official listing and privacy policy explicitly stating that no personal data is collected.

The compromised platforms include ChatGPT, Claude, Gemini, Grok, Meta AI, DeepSeek, Perplexity, and both the consumer and enterprise iterations of Microsoft Copilot.

Deep Dive into the Surveillance Mechanism

Unlike many forms of spyware that require user interaction beyond initial installation, this extension operates autonomously. Immediately upon loading, its background worker forcibly sets internal storage values to “agreed” for consent, “on” for collection, and “off” for protection, effectively overriding any user preferences.

A background listener continuously monitors tabs.onUpdated without any URL filtering. This means that any page visit within the browser triggers the extension to retrieve a remote configuration file, which refreshes every 60 seconds and dictates its data capture rules.

The core capture engine is concealed within a file deceptively named chatgpt_context_fetch_diagnostics.js. Despite its diagnostic label, this component is designed to operate across all nine targeted AI platforms. It achieves this by replacing fundamental browser networking functions, specifically window.fetch, XMLHttpRequest.open, XMLHttpRequest.send, and the WebSocket constructor.

According to security researcher Jean-Marie’s review on the Chrome Web Store, this method of overriding browser functions allows the extension to intercept network traffic before it ever reaches the intended AI service.

Where network interception might be insufficient, the extension employs three distinct MutationObservers to directly scrape assistant replies from rendered web pages. Additionally, keyloggers are deployed to capture user inputs on platforms such as Meta AI even before messages are officially submitted.

Corporate Risk and Data Exfiltration

This extension presents significant risks to corporate environments, particularly given its specific targeting of Microsoft 365’s tenant-hosted Copilot. It actively parses SignalR protocol frames to extract both user prompts and bot responses from these enterprise interactions.

Organizations that permit the use of this extension within their networks face a severe risk of confidential corporate communications being leaked outside their established security boundaries. Such data leakage vectors underscore broader concerns surrounding AI prompt vulnerabilities in enterprise settings.

Captured data undergoes batching, compression, and AES-GCM encryption before being transmitted to ingest.secondbrain.is/context. Crucially, the encryption key is not generated locally but is issued directly by SecondBrain’s servers. This server-side control over the key allows the provider to decrypt every uploaded conversation batch, a fact verified by researchers through the successful decryption of intercepted traffic and matching authentication tags.

Discrepancy Between Policy and Practice

There is a stark contrast between SecondBrain’s publicly stated privacy policies and its actual technical implementation. While the extension’s store listing explicitly claims no user data collection, the interface offers no functional mechanism to disable the background harvesting of information, as detailed in the MalExt Sentry report.

The only visible toggle merely controls the appearance of a floating UI button, while older consent screens within the codebase remain dormant and non-functional.

What You Should Do

• Block the Extension: Immediately implement policies to block the extension ID aajjgdpofhhcjmjoombjdfepplndhgcp using ExtensionInstallBlocklist in Google Chrome and Microsoft Edge.
• Monitor Network Activity: Audit network logs for any outbound connections to ingest.secondbrain.is and optimize.secondbrain.is, as these are the designated data exfiltration endpoints.
• Assess Enterprise AI Usage: Organizations utilizing Microsoft 365 Copilot must consider this extension a critical data exfiltration threat and not merely a consumer privacy concern. Review and enforce strict policies regarding browser extension installations.
• Educate Users: Inform employees about the risks associated with installing unverified or malicious browser extensions, especially those interacting with AI services.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.