Full Breakdown
Data Harvesting by Urban VPN Chrome Extension Raises Privacy Concerns
12/15/2025, 11:46:27 PM
Overview of the Data Harvesting Incident
The Urban VPN Proxy extension, available on the Google Chrome Web Store and Microsoft Edge Add-ons marketplace, has been implicated in a significant data harvesting operation. With over eight million downloads, the extension has been found to silently collect user prompts and responses from various AI chatbots, including OpenAI's ChatGPT, Anthropic's Claude, and Google's Gemini. This functionality was enabled by default in an update released on July 9, 2025, which introduced JavaScript scripts designed to intercept and exfiltrate conversation data to Urban Cyber Security Inc.'s servers.
Mechanism of Data Collection
The extension utilizes tailored JavaScript executors that are injected into browser sessions when users interact with AI platforms. This allows the extension to override standard browser APIs, capturing not only user inputs but also the AI's responses, along with metadata such as conversation identifiers and timestamps. The data is sent to remote servers at "analytics.urban-vpn.com" and "stats.urban-vpn.com." Despite its claims of providing secure VPN services, the extension's updated privacy policy indicates that it collects this data for marketing analytics and Safe Browsing enhancements.
Official Statements & Responses
Koi Security's Idan Dardikman highlighted the deceptive nature of Urban VPN's practices, stating, "Users who installed Urban VPN for its stated purpose – VPN functionality – woke up one day with new code silently harvesting their AI conversations." The privacy policy mentions that while data is collected for analytics, it does not guarantee the complete removal of sensitive information, raising concerns about user privacy.
Criticism & Opposition
Critics have pointed out that the extension's privacy policy lacks transparency regarding the extent of data collection. Users who installed the extension prior to the July 2025 update were not given the opportunity to consent to these new practices. Furthermore, the extensions do not provide an option to opt out of AI data collection independently from other features, leaving many users unaware of the ongoing data harvesting.
Conflicting Reports & Gaps
While Urban VPN claims that it does not sell user data to third parties, Koi Security's findings suggest that the data is shared with BIScience, a marketing analytics firm. This discrepancy highlights a gap in user understanding regarding how their data is utilized and the potential risks associated with using such extensions.
What's Next
The ongoing scrutiny of Urban VPN and similar extensions may lead to increased regulatory oversight and calls for clearer privacy policies from browser extension developers. Users are advised to remain vigilant about the permissions they grant to extensions and to consider the implications of data collection practices on their privacy.
Verbatim Quotes
- “Users who installed Urban VPN for its stated purpose – VPN functionality – woke up one day with new code silently harvesting their AI conversations.” — Idan Dardikman, Koi Security
- “The harvesting feature sends that exact sensitive data - and everything else - to Urban VPN's own servers, where it's sold to advertisers.” — Idan Dardikman, Koi Security
- “It states that “AI Inputs and Outputs” are considered part of the user’s web browsing data and may be shared with its affiliate BiScience.” — Urban VPN Privacy Policy
The revelations surrounding Urban VPN Proxy underscore the critical need for users to be aware of the privacy implications of browser extensions, especially those that interact with sensitive AI technologies.
