- Urban VPN Proxy started harvesting prompts and responses from AI chatbots after a July 2025 update
- Collected data, including metadata and conversation IDs, is shared with BIScience for advertising analytics purposes.
- Multiple related Urban extensions perform the same data collection at scale
A popular Google Chrome browser extension has been found to scrape everything its users ask from many of the biggest AI tools on the market, as well as chatbot responses, all seemingly in an effort to make a few extra bucks for its owners.
Urban VPN Proxy has over six million installs and a 4.7/5 rating on the Google Chrome Web Store – and on the Microsoft Edge add-on market, it has an additional 1.3 million installs.
Previously, it worked like your regular VPN – hiding the user’s real IP address and thus bypassing geoblocks and other various restrictions. However, as Koi security researchers discovered, on July 9, 2025, the extension was updated to version 5.5.0, which introduced AI harvesting by default.
Privacy Policy Updates
Everything users entered into ChatGPT, Anthropic Claude, Microsoft Copilot, DeepSeek, Google Gemini, Grok, Meta AI, and Perplexity would be retrieved, along with everything those tools returned. Additionally, the extension also extracted conversation IDs, timestamps, session metadata, and the platform and AI model used.
The company behind the extension, called Urban Cyber Security, makes no secret of its practices, noting in its privacy policy document how it collects “anonymized” data and shares it with BIScience, another company it owns.
This company is an affiliated advertising and brand monitoring organization. In other words, it analyzes anonymized online behavior at scale, helping businesses understand advertising performance, consumer journeys, and competitive activity.
Although Urban says it deletes personally identifiable data and does its best not to share sensitive information, the company emphasizes that this cannot be guaranteed.
“However, the purpose of this processing is not to collect any personal or identifiable data, we cannot fully guarantee the deletion of all sensitive or personal information, we implement measures to filter or eliminate any identifiers or personal data you may submit through the prompts and to de-identify and aggregate data,” the privacy policy reads.
Koi researchers said that the same company has several extensions, all of which collect the same data: 1ClickVPN Proxy, Urban Browser Guard, and Urban Ad Blocker.
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
