- Urban VPN Proxy started collecting AI chatbot prompts and responses after a July 2025 update
- The collected data, including metadata and conversation IDs, is shared with BIScience for ad analysis.
- Several related urban extensions perform the same large-scale data collection.
A popular Google Chrome browser extension has been found to collect everything its users request from most major AI tools, in addition to collecting chatbot responses, all apparently to earn a few extra bucks for its owners.
Urban VPN Proxy has over six million installs and a 4.7/5 rating on the Google Chrome Web Store, and on the Microsoft Edge add-on market, it has an additional 1.3 million installs.
It used to work like a regular VPN: it hid the user’s real IP address and thus bypassed geoblocks and other various restrictions. However, as Koi security researchers discovered, on July 9, 2025, the extension was updated with version 5.5.0, which introduced AI harvesting by default.
Privacy Policy Updates
Anything users typed into ChatGPT, Anthropic Claude, Microsoft Copilot, DeepSeek, Google Gemini, Grok, Meta AI, and Perplexity would be collected, as well as anything these tools returned. Additionally, the extension also extracted conversation IDs, timestamps, session metadata, and which platform and AI model was used.
The company behind the extension, called Urban Cyber Security, makes no secret of its practices and notes in its privacy policy document how it collects “anonymized” data and shares it with BIScience, another company it owns.
This company is an affiliate advertising intelligence and brand tracking organization. In other words, it analyzes anonymous online behavior on a large scale, helping companies understand advertising performance, consumer journeys, and competitive activity.
While Urban says it removes personally identifiable data and makes every effort not to share sensitive information, the company emphasizes that this cannot be guaranteed.
“However, the purpose of this processing is not to collect personal or identifiable data, we cannot completely guarantee the deletion of all personal or sensitive information, we implement measures to filter or remove any identifiers or personal data that you may submit through the prompts and to de-identify and aggregate the data,” the privacy policy reads.
Koi researchers said that the same company has multiple extensions, all of which collect the same data: 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
