Fake ChatGPT and DeepSeek Extensions Spied on Over 1 Million Chrome Users

Security researchers have identified two malicious Chrome extensions recording AI chats. Learn how to identify and remove these tools to protect your privacy.

The convenience of AI chatbots has come with a hidden cost for nearly a million Chrome users. On December 29, 2025, cyber threat defence experts at OX Security revealed that two popular browser extensions were secretly recording private conversations and sending them to outside servers.

This discovery is part of a disturbing new trend that researchers at Secure Annex have named Prompt Poaching, where attackers specifically target the sensitive questions and proprietary data we feed into tools like ChatGPT.

Malicious Chrome Extensions

The two tools at the centre of OX Research’s investigation are “Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI” (600,000 installs) and “AI Sidebar with Deepseek, ChatGPT, Claude and more” (300,000 installs).

Researchers explained in the blog post that ...