Full Breakdown
Data Harvesting Through Urban VPN Proxy: A Cautionary Tale
12/20/2025, 4:09:08 AM
Overview of the Data Harvesting Operation
A recent investigation by the Tel Aviv-based security firm Koi has revealed a significant data harvesting operation linked to the Urban VPN Proxy, a Google Chrome extension with approximately six million users. This extension, which has received a "featured" badge from Google, employs hidden "executor" scripts that intercept and capture user conversations from popular AI platforms, including OpenAI's ChatGPT, Anthropic's Claude, Google's Gemini, DeepSeek, and xAI's Grok. The data collected encompasses sensitive information such as medical inquiries, financial details, proprietary code, and personal dilemmas, which are subsequently sold for marketing analytics purposes.
Mechanism of Data Collection
The data harvesting occurs regardless of whether the VPN functionality is activated. Once installed, the scripts automatically begin collecting data without any user intervention required. Notably, there is no user-facing toggle to disable this data collection; the only method to stop it is to uninstall the extension entirely. Urban Cyber Security Inc., the company behind Urban VPN Proxy, explicitly states in its privacy policy that it shares web browsing data with its affiliated data broker, BiScience, which processes this raw data into commercial insights for distribution to business partners.
Official Statements & Responses
Koi researcher Idan Dardikman emphasized the severity of the situation, advising users to uninstall the extension immediately and to assume that any AI conversations they have had since July 2025 have been captured and shared with third parties. Despite the alarming findings, the Urban VPN Proxy listing on the Chrome Web Store claims that user data is not sold to third parties outside of approved use cases and is not used for purposes unrelated to the extension's core functionality. This assertion appears inconsistent with the technical behavior observed in the software.
Criticism & Opposition
Critics have raised concerns about the implications of such data harvesting practices, particularly regarding user privacy and consent. The existence of similar data collection mechanisms in other extensions developed by Urban Cyber Security Inc. further complicates the landscape, as over two million additional users across seven other apps may also be affected. Dardikman's findings highlight the need for users to scrutinize privacy policies of all applications they utilize, as many may contain similar permissions for data sharing.
Conflicting Reports & Gaps
While the investigation by Koi provides a detailed account of the data harvesting practices associated with Urban VPN Proxy, there is a lack of independent verification of the claims made regarding the extent of data collection and its implications. Furthermore, discrepancies exist between the company's privacy policy and the actual functionality of the extension, raising questions about transparency and accountability in data handling practices.
Verbatim Quotes
- “if you have any of these extensions installed, uninstall them now. Assume any AI conversations you’ve had since July 2025 have been captured and shared with third parties.” — Idan Dardikman, Koi Researcher
- “we share the Web Browsing Data with our affiliated company,” identified as BiScience, “that uses this raw data and creates insights which are commercially used and shared with business partners.” — Urban Cyber Security Inc. Privacy Policy
The findings from Koi serve as a critical reminder of the potential risks associated with seemingly benign browser extensions and the importance of vigilance regarding data privacy.
