Chrome Extension Secretly Exfiltrates AI Prompts to Vendor Servers

A Chrome extension marketed as a "Prompt Optimizer" performs its advertised rewriting function normally, but researchers found it also runs a hidden capture engine injected at document_start on nine major AI chat platforms. Without any user interaction—the extension never needs to be opened—it silently fetches a userId and encryption credentials from a remote server, then intercepts both the user's prompt and the AI's response, encrypting them before POSTing to the vendor's ingest endpoint.

The behavior was reproduced on a clean browser profile with devtools attached to the service worker, confirming exfiltration occurs from mere installation and normal browsing—no click, popup, or extension UI interaction required. This directly contradicts the extension's Chrome Web Store privacy declaration, which states the developer does not collect user data.

For engineers, this is a reminder that extension manifests and store privacy labels are self-reported and unverified. Content scripts running at document_start have broad access on sensitive domains like AI chat interfaces, and can exfiltrate sensitive conversational data—including proprietary code, credentials, or business logic pasted into prompts—entirely outside the visible extension UI.