A Chrome extension called "Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI" sat near the top of Chrome Web Store search results, carrying a Featured badge and roughly 600,000 users. Researchers at OX Security found it copied ChatGPT and DeepSeek conversations, along with full browsing history, to a remote server every 30 minutes. The company reported the extension to Google on 29 December 2025. Months later, it was still downloadable.
What happened inside the Chrome Web Store
OX Security discovered two extensions built to mimic a legitimate AI sidebar tool called AITOPIA, which has about 1 million users. The imitators were not small operations. The extensions had been downloaded more than 900,000 times via the Chrome Web Store, indicating broad adoption before the malicious behavior came to light.
The mechanics were simple and persistent. Two malicious extensions were found exfiltrating user conversations and all Chrome tab URLs to a remote C2 server every 30 minutes. OX Security flagged both to Google, yet both extensions remain live and actively downloadable on the Chrome Web Store, with the first extension still carrying its 'Featured' badge.
Removal does not end the problem, either. A related extension named "AI Sidebar with DeepSeek, ChatGPT, Claude and more" had already amassed over 300,000 installs and a 4.6-star rating on the Chrome Web Store before Google pulled it in January 2026. By August 2026, the extension is active on the Chrome Web Store again, and Netskope says enterprise endpoints are currently receiving updates carrying a different kind of payload. Microsoft later formalised the warning in its own advisory, describing a campaign that reached nearly 900,000 installs and activity across more than 20,000 enterprise tenants.
Who installs AI browser extensions, and why they're risky
This is not a niche problem confined to a handful of rogue listings. 99% of enterprise users have at least one extension installed, and about 15% of enterprise users have an AI extension installed. Once installed, those AI tools behave differently from ordinary extensions. AI extensions are 60% more likely to have a CVE, 3x more likely to have access to cookies, and 2.5x more likely to be able to execute remote scripts.
The risk does not stay fixed at install time. 64% of users have at least one AI extension that changed its permissions in the past 12 months, compared to 34% of users across all extensions. Transparency is also thin across the category: over 71% of all extensions, AI or otherwise, don't even have a privacy policy, and more than 73% of enterprise users have at least one extension installed that provides no transparency into how it handles their data.
For a small business running a website, a CMS login, a payment dashboard, or a client inbox often sits inside the same browser session as that AI extension. A compromised extension does not need to hack your systems separately. It already has a seat inside the browser tab where you do your work.
Before approving any AI extension on a work device, check these points:
- Publisher identity: does the developer name match a known company, or a generic account created recently?
- Install count and reviews: a high number alone does not guarantee safety, since impersonators can buy early traction.
- Requested permissions: does the extension need access to all sites, or only the one it claims to help with?
- Privacy policy: is one published, and does it name where data goes?
- Update history: has the extension changed ownership or permissions recently?
What the numbers show about extension risk and growth
The category is expanding quickly. One review of extension-store data projects the global AI browser market growing at a 32.8% compound annual growth rate between 2025 and 2034. Researchers tracking malicious listings over a nine-month window identified 154 previously undetected malicious Chrome extensions, and after cross-checking against earlier disclosures, this resulted in a final set of 341 malicious extensions for analysis.
Separately, Unit 42 researchers took direct action rather than just counting. The team specifically reported 18 high-risk extensions to Google, which either removed the extensions or sent a warning to the owners of the extensions to address policy violations.
Here is the trade-off that makes vetting harder: popularity signals are unreliable in this category. 33% of AI extensions have fewer than 5,000 users, and nearly 50% of AI extensions have less than 10,000 users, which means a small install base is normal, not automatically a warning sign, and a large one is not automatically proof of trust.
What comes next for extension vetting
Microsoft's own guidance now draws a sharp line for IT teams. Its advisory recommends that any extensions impersonating AI assistants with names that reference ChatGPT, Claude, Gemini, DeepSeek, or similar AI platforms but originating from publishers without an established security posture should be blocklisted and removed from managed endpoints. The Cloud Security Alliance frames the underlying fix as structural rather than case by case: a foundational structural control against shadow AI browser extensions is allowlist-based extension management enforced through enterprise browser policy.
Ownership changes add a quieter risk that a one-time review cannot catch. A browser extension called QuickLens, later renamed ShotBird, changed owner to "[email protected]" on the Chrome Web Store listing page on 1 February 2026, after which it was found capable of stealing passwords, browsing history, and extension-related information. Extensions banned for AI-chat theft have also resurfaced under new payloads, as the AI Sidebar case and a separate group of VPN and ad-blocker extensions have shown.
For a website operator or small IT team, that pattern argues against treating extension approval as a single decision made once. It argues for a short recurring check instead: a monthly look at what is installed, what permissions each tool now holds, and whether the publisher behind it has changed. Google has removed listings each time researchers have reported them, but new impersonators keep appearing under new names. Whether the Chrome Web Store moves to continuous behavioural screening, rather than reactive takedowns after researchers flag a campaign, remains the open question for anyone deciding which AI tool gets a seat inside their browser.
