Are AI Chrome extensions safe? What any extension can read on your AI chats

The Morse teamPublished November 6, 20269 min read

AI Chrome extensions are only as safe as the site access you give them: any extension, AI or not, that can "read and change all your data on all websites" can read your ChatGPT, Claude, and Gemini chats as you type them. Since December 2025, security researchers have published three cases of extensions doing exactly that, including a free VPN with 6 million Chrome users and two AI sidebars with 900,000 between them, and several carried Google's "Featured" badge. As of November 6, 2026, some of those extensions are still in the Chrome Web Store.

We read Chrome's extension documentation and Web Store policies, Mozilla's and Apple's pages on extension permissions, and each researcher's original report on November 6, 2026, and checked the extensions' Chrome Web Store listings the same day. Koi's report now redirects to Palo Alto Networks, and OX Security's site blocks automated reads, so for both we read archived copies. Each finding about an extension's code belongs to the researcher who made it, and we name them. Google deserves credit for its store rules, which already ban what these extensions are accused of, including selling user data to data brokers.

Can browser extensions read your ChatGPT conversations?

Yes, if you've given them access to the site. Chrome calls this a host permission, and its developer docs list what it unlocks: scripts injected into the page, the page's address and title, its cookies, and its network requests. An AI chat is a web page like any other, so an extension with access to chatgpt.com sees your prompt as you type it and each reply as it arrives.

Koi's December 15, 2025 report on Urban VPN Proxy shows how far that goes (Koi, archived). According to Koi, the extension injected a separate script into each AI site, "chatgpt.js, claude.js, gemini.js, and so on," which wrapped the browser's own fetch() and XMLHttpRequest functions, so "every network request and response on that page passes through the extension's code first." Koi says the script picked out each prompt, each reply, conversation IDs, and timestamps, and sent them to Urban VPN's servers whether the VPN was connected or not.

The AI company can't block this from its side. The extension runs in your browser, with your permission, after the browser has decrypted everything for you to read.

What does each extension permission let it see on an AI chat page?

The warning Chrome or Firefox shows when you install an extension tells you how much of the page it can reach. We matched each wording to Google's permission list and Mozilla's Extension Workshop, read on November 6, 2026.

One warning can hide another. Google's warning guidelines say the tabs warning "won't show if the extension also requests '<all_urls>'," since the broader one covers it. activeTab is the narrowest row. Google says an extension built that way "only obtains access to a tab in response to an explicit user gesture."

Have extensions been caught stealing ChatGPT chats?

Yes, three times in published research since December 2025. The table lists what each researcher reported and what the extension's Chrome Web Store page showed when we checked on November 6, 2026. We haven't analyzed the current versions, so we can't say what they do now.

Some coverage still says the OX extensions are gone. GIGAZINE wrote on January 8, 2026 that "all of the Chrome extensions in question have been removed" (GIGAZINE). On November 6, both extension IDs opened live listings with new names and newer versions. If you're checking your own browser against a report, match the extension's ID, not its name.

Urban VPN's listing still says your data is "Not being sold to third parties, outside of the approved use cases." Its privacy policy, last updated September 1, 2026, says "our parent company is a data broker" and that it "may sell or otherwise disclose raw Personal Information to our affiliates or parent company." The "AI Inputs and Outputs" section Koi quoted is no longer in it.

Does Google's Featured badge mean an extension is safe?

No. Google's discovery page calls badges "an added signal of quality and trust on vetted items," and all three campaigns above had Featured extensions in them. Koi counted Featured badges on seven of Urban VPN's eight extensions across the Chrome and Edge stores.

Google's Limited Use policy prohibits "transferring or selling user data to third parties like advertising platforms, data brokers, or other information resellers," and says "collection and use of web browsing activity is prohibited, except to the extent required for a user-facing feature described prominently" on the store page. Its program policies tell developers to "request access to the narrowest permissions necessary." Each case above is an extension accused of breaking those rules after passing review.

Are AI sidebar extensions private?

Even an honest one sends what you ask, and often the page you're on, to servers you don't know about. A sidebar has to put your question to a model somewhere. OX quotes the genuine AITOPIA sidebar's policy as saying chats are saved "on AITOPIA.ai servers in Amazon US Data server," which OX calls "legitimate behavior with proper disclosure."

The fake ones go further. Akamai says the AiFrame extensions used Mozilla's Readability library to pull "titles, text content, excerpts, and site metadata" from the active tab when a remote page asked for it, and that the remote page could switch on speech recognition and receive the transcript. When one was removed on February 6, 2025, Akamai says "an identical extension was published under a new ID and name" two weeks later. That copy is the AI Sidebar still listed today.

A sidebar that reads the page you're on can be steered by that page, too. Our guide to prompt injection covers how hidden text in a page gets an assistant to act on it, and is Perplexity Comet safe and is Dia browser safe cover the browsers that build the sidebar in.

How do you check which extensions can read your AI chats?

Start with site access, since it's the one setting that cuts an extension off from your AI chats without uninstalling it.

• Chrome. Go to chrome://extensions, choose Details on each extension, and find "Allow this extension to read and change all your data on websites you visit." Change it to On select, which Chrome's help page describes as access "to the current site in the open tab or window when you select the extension," or to On specific sites with a short list. Remove anything you don't recognize.
• Firefox. Click the extensions button (the puzzle piece) and the gear next to each extension to choose which sites it may use. Mozilla's help page describes this for Manifest V3 extensions (Mozilla, archived).
• Safari. On a Mac, open Safari, then Settings, then Websites, select the extension, and set each site to Ask, Allow, or Deny. On an iPhone, it's Settings, Safari, Extensions (Apple).

Three limits apply. Chrome says site access doesn't cover "extensions that change lower-level network access through VPNs or proxy settings," so a VPN extension needs a separate decision. Chrome pauses an extension that adds a permission with a new warning until you accept it (Google), but an extension that already reads every site can change what it does with that access without asking. Koi says Urban VPN's AI collection arrived in a silent update. Firefox doesn't show you new host permissions an update requests (MDN, last modified April 21, 2026). For an AI chat you'd hate to see copied, a browser profile with no extensions at all is the simplest fix.

How to keep your Morse chats away from extensions

Every harvest above read the chat in the browser tab where it's shown. Morse is a web app at trymorse.ai, so an extension you've let read every site can read what Morse shows you, the same as anywhere else, in every privacy mode. E2EE seals a message on your device before it leaves, and an extension reading the page sees it before that. So set extensions to On select or keep a clean browser profile for your chats. Outside the tab, this is how Morse is built:

• No chat history on our servers. Morse's servers don't keep messages or log what you write, and your account holds sign-in details, plan, balance, and a usage ledger with no content. Your history is stored only in your browser, encrypted.
• No ad or analytics tags on the page. Morse runs no advertising trackers or third-party analytics, so no ad tag on the page receives a chat's title or text. Our study of AI chatbots sharing data with trackers shows what those tags picked up elsewhere.
• Locked when you sign out. Opening your history takes two keys, one that never leaves your device and one our server gives you at sign-in, so a copy of your browser's data alone can't be read.

Then pick a mode for where the message goes after it leaves the tab:

• E2EE, for what no one but the model should read. Your browser checks the enclave's hardware attestation, then encrypts the message so only that enclave can read it, and Morse's servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models, with no web search.
• Private, the default, for everyday chats with DeepSeek, Kimi, GLM, or Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, for GPT, Claude, or Gemini without your name on it. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider sees the text without knowing it's you and may keep it for a limited time to check for abuse, under its own policy.

Morse doesn't train AI on your content or sell your data. If you clean up your browser after removing an extension, clearing site data for trymorse.ai deletes your Morse chats for good, and Morse can't recover them, so copy anything you need first.

Trim your extensions, then try a chat from the Morse home page without an account, or start free with no card needed. E2EE chats come with Pro, at $19 a month.