The Urban VPN Scandal: Corporate Security Policies and Privacy Risks
When Trusted Tools Betray Users
AI Chats of 8 Million Users Sold: Urban VPN Scandal and the Collapse of Digital Security
A discovery reported in mid-December 2025 is challenging the concept of privacy in the age of artificial intelligence. Researchers at Tel Aviv-based security firm Koi Security found that "privacy" plugins, trusted by millions of users, were actually silently collecting their most intimate digital chats and selling them to data brokers.
Idan Dardikman, co-founder and CTO of Koi Security, describes the start of the research: While sharing his thoughts with Claude about an important decision in his life, he realized how intimately he had been talking to this AI assistant for months. Health questions, financial details, work problems, things he hadn't told anyone... And then that unsettling thought: "What if someone is reading all this?"
As a security researcher, Dardikman had the tools to answer this question. Using Koi’s AI-powered risk engine Wings, they scanned browser extensions capable of reading and leaking conversations from AI chat platforms. Their expectation was to find a few obscure extensions with low installation numbers from suspicious publishers.
The results painted a completely different picture.
Discovery: Spy Wearing the "Featured" Badge
At the top of the list was Urban VPN Proxy: over 6 million users, a 4.7-star rating from 58,000 reviews, and Google's "Featured" badge. According to Google's own documentation, this badge meant the extension "followed technical best practices and met high-quality user experience and design standards." Each extension was manually reviewed by the Chrome Web Store team before receiving this badge.
Urban VPN Proxy was a free VPN service promising privacy and security—exactly the kind of tool people download when they want to protect themselves online. The reality, however, was quite different.
Technical Anatomy: How Does an Attack Work?
The platforms targeted by Urban VPN Proxy were noteworthy: ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok (xAI), and Meta AI. These are eight of today's most popular AI assistants.
Step 1: Script Injection
The plugin constantly monitors the user's browser tabs. When the user navigates to any of the target AI platforms, it injects a custom "executor" script into the page. A separate script exists for each platform: chatgpt.js, claude.js, gemini.js, and others.
Step 2: Compromising Browser APIs
The injected script overrides the `fetch()` and `XMLHttpRequest` functions. These are the core browser APIs that manage all network requests. This is an aggressive technique: the script wraps the original functions, forcing every network request and response on the page to pass through the plugin's code first.
What does this mean? When Claude sends you a reply or you send a prompt to ChatGPT, the plugin sees the raw API traffic before your browser displays it on the screen.
Step 3: Data Packaging and Exfiltration
The injected script parses the captured API responses to extract speech data: user prompts, AI responses, timestamps, and speech IDs. This data is packaged and sent to the plugin's content script via window.postMessage, tagged with the identifier PANELOS_MESSAGE.
Content scripting passes data to the plugin's background service worker. The data is compressed. analytics.urban-vpn.com And stats.urban-vpn.com The data is routed to Urban VPN servers, including those mentioned.
Data Collected
According to Koi Security's analysis, everything that was captured includes the following:
- Every prompt sent to the AI
- Every response received
- Speech identifiers and timestamps
- Session metadata
- Information about the AI platform and model used.
Timeline: The Silent Update Trap
AI speech collection capability was not present from the beginning. According to Koi Security's analysis:
-Prior to version 5.5.0: No AI collection function
-July 9, 2025: Version 5.5.0 has been released, AI data collection is enabled by default.
-July 2025 - Now: All user conversations with the targeted AI platforms were intercepted and leaked.
Chrome and Edge extensions update automatically by default. Users who installed Urban VPN for its intended VPN functionality woke up one morning to new code silently collecting AI conversations.
Anyone using ChatGPT, Claude, Gemini, or other targeted platforms while Urban VPN is installed after July 9, 2025, should assume that these conversations are now on Urban VPN servers and being shared with third parties. Medical questions, financial details, private codes, personal dilemmas—all sold for “marketing analytics purposes.”
The "AI Protection" Deception
Urban VPN's Chrome Web Store listing highlights "AI protection" as a feature:
“Advanced VPN Protection – Our VPN offers additional security features to help protect your browsing experience from phishing attempts, malware, intrusive ads, and AI protection that checks your prompts for personal data, reviews AI chat responses, and displays warnings for suspicious links.”
The framing implies that AI tracking exists to protect you. The code, however, tells a different story. Data collection and “protection” notifications operate independently. Enabling or disabling the alert feature does not affect whether your conversations are captured and leaked. The plugin collects everything regardless.
The protection feature occasionally displays warnings about sharing sensitive data with AI companies. The data collection feature, however, sends that very sensitive data—and everything else—to Urban VPN's own servers, where it's sold to advertisers. While the extension warns you about sharing your email with ChatGPT, it simultaneously relays your entire conversation to a data broker.
The Unseen Part of the Iceberg: 8 Million Users
After documenting the behavior of Urban VPN Proxy, Koi Security researchers checked to see if the same code existed elsewhere. It did. The same AI aggregate function was found in seven more extensions from the same publisher, both in Chrome and Edge:
Chrome Web Store:
- Urban VPN Proxy - 6,000,000 users
- 1ClickVPN Proxy - 600,000 users
- Urban Browser Guard - 40,000 users
- Urban Ad Blocker - 10,000 users
Microsoft Edge Add-ons:
- Urban VPN Proxy - 1,323,622 users
- 1ClickVPN Proxy - 36,459 users
- Urban Browser Guard - 12,624 users
- Urban Ad Blocker - 6,476 users
Total affected users: Over 8 million.
The extensions are spread across different product categories—a VPN, an ad blocker, a “browser protection” security tool—but they share the same surveillance infrastructure. Users who install the ad blocker have no reason to expect Claude's conversations to be collected.
Except for Urban Ad Blocker, all of these extensions for Edge carry the "Featured" badge from their respective stores.
Behind the Scenes: BiScience Data Brokerage Network
Urban VPN is operated by Urban Cyber Security Inc., based in Delaware. This company is affiliated with a data brokerage firm called BiScience (B.I Science (2009) Ltd.).
BiScience had previously been on the radar of security researchers. John Tuckner from Secure Annex and security researcher Wladimir Palant had previously documented BiScience's data collection practices. Their research revealed the following:
- BiScience collects clickstream data (browsing history) from millions of users.
- The data is linked to persistent device identifiers that enable re-identification.
- The company provides an SDK to third-party plugin developers to collect and sell user data.
- BiScience sells this data through products like AdClarity and Clickstream OS.
According to research published in January 2025, BiScience has been engaging in this type of data collection since at least 2019, exploiting loopholes in Chrome Web Store policies.
Koi Security's finding represents an expansion of this operation. BiScience has moved from collecting browsing history to collecting full AI conversations—a significantly more sensitive category of data.
Urban VPN's privacy policy confirms data flow: "We share web browsing data with our affiliate BiScience... BiScience uses this raw data to create commercially used insights that are shared with Partners."
The Paradox of Explanation: Apparent Transparency
To be fair, Urban VPN does reveal some of this—if you know where to look.
Request for approval (Shown during plugin installation), the plugin mentions that it processes “ChatAI communication” along with “pages you visit” and “security signals.” It states that this is done “to provide these protections.”
Privacy policy It goes even further, buried deep within the document: “AI Inputs and Outputs. As part of Scanning Data, we will collect prompts and outputs queried by the End User or generated by the AI chat provider.” And: “We also disclose AI prompts for marketing analytics purposes.”
However, the Chrome Web Store list—where users actually make the decision to upload—presents a different picture: “This developer declares that your data is not sold to third parties except for approved use cases.”
Contradictions are important:
1. The consent request frames AI tracking as protective. The privacy policy reveals that data is sold for marketing purposes.
1. The store listing states that data is not sold to third parties. The privacy policy explains sharing with BiScience and “Partners”.
1. Users who installed before July 2025 have never seen the updated confirmation prompt.
1. There's no option to accept the VPN and refuse AI collection. It's all or nothing.
1. Data collection continues even when the VPN connection is disconnected and the AI protection feature is turned off.
Google's Responsibility: The Failing Guarantee of the "Featured" Badge
Urban VPN Proxy carried Google's "Featured" badge in the Chrome Web Store. According to Google's documentation: "Featured extensions follow our technical best practices and meet high-quality user experience and design standards." And: "Before receiving the Featured badge, the Chrome Web Store team must review each extension."
This means that someone at Google reviewed Urban VPN Proxy and concluded that it met their standards. Either the review didn't examine the code that collects conversations from Google's own AI product (Gemini), or it did and didn't see it as a problem.
Chrome Web Store's Limited Use policy explicitly prohibits "transferring or selling user data to third parties such as advertising platforms, data brokers, or other information vendors." BiScience, by its own definition, is a data broker.
Structural Problems of the Browser Plugin Ecosystem
The Urban VPN scandal is not an isolated incident. The security risks of browser extensions have been known for a long time.
Inadequate Plugin Review Process
Researchers at the University of Wisconsin-Madison demonstrated in 2023 that a password-stealing extension successfully bypassed the Chrome Web Store's review process, despite Google's Manifest V3 security standard. The researchers discovered that passwords were stored in plain text within the HTML source code of websites.
In April 2025, it was revealed that 35 suspicious extensions had been downloaded more than 4 million times, with at least 10 of them bearing Google's "Featured" badge. By December 2024, more than 30 extensions were identified as malicious; 20 of these were stealing credentials and session cookies.
The most recent example occurred on December 24, 2025: The Trust Wallet Chrome extension was hacked, resulting in a loss of $7 million in cryptocurrency. The attacker submitted a malicious version of the extension using a leaked Chrome Web Store API key, and this version successfully passed Google's review.
"Silent Update" Problem
The automatic update feature of browser extensions is a double-edged sword in terms of security. While it enables the rapid distribution of security patches, it also allows an initially harmless extension to transform into malicious code.
In the case of Urban VPN, users who installed the extension before July 2025 were updated with AI data collection features without any warning. This means millions of users were unknowingly placed under surveillance.
Limitations of Manifest V3
Google's Manifest V3 standard was designed to improve plugin security. By preventing code downloads from remote websites, it prevented plugins from altering their functionality after installation. However, research has shown that this standard is insufficient.
Manifest V3 still cannot prevent plugins from accessing the entire content of web pages. This includes everything, including text fields where users enter sensitive data such as passwords, social security numbers, and credit card information.
The Position of AI Companies: Technical Reality
The original article mentions the "indirect responsibility" of AI companies. Let's examine this claim more closely.
The Encryption Issue
Communication with AI platforms (ChatGPT, Claude, Gemini, etc.) is already encrypted with HTTPS/TLS. The problem isn't a lack of encryption. Malicious extensions like Urban VPN intercept data before encryption happens—inside the browser, at the DOM level.
This is an area that AI companies cannot directly control. There is very little that can be done on the server side against malware that a user installs on their computer.
Security Practices of AI Companies
But this doesn't mean AI companies can't do anything:
OpenAI: In December 2025, the company acknowledged that prompt injection was a “long-term AI security problem.” The firm developed an “LLM-based automated attacker”—a bot that plays the role of a hacker and seeks ways to inject malicious instructions into AI agents.
Anthropic: Claude for Chrome launched as a limited beta in August 2025. Through extensive testing, it reduced the prompt injection success rate from 23.6% to 11.2%. Financial services and cryptocurrency platforms were blocked by default.
Google: In December 2025, Google announced “User Alignment Critic”—a second AI model that examines every action the primary agent intends to take. Google also offers a $20,000 reward to researchers who find security vulnerabilities.
Actual Distribution of Responsibility
The blame cannot be placed on a single party. This is a multi-layered security issue:
1. Browser manufacturers (Google, Microsoft): Strengthening plugin review processes and raising the standards for the "Featured" badge.
1. Plugin stores: Developing behavioral analysis and continuous monitoring mechanisms.
1. AI platforms: Informing users about the risks, exploring additional layers of protection.
1. Corporate security teams: Creating a plugin whitelist, monitoring plugins on corporate devices.
1. Users: Improving digital literacy, reviewing the permissions of installed plugins.
What should users do?
If any of the listed add-ons are installed:
1. Remove it immediately. Imagine that all your AI conversations from July 2025 onwards are captured and shared with third parties.
1. Review plugin permissions regularly. Be wary of plugins that request access to data not necessary for their basic functionality.
1. Be suspicious of free VPN services. Google warned users about free VPNs in November 2025.
1. Don't blindly trust the "Featured" badge. This badge does not guarantee a thorough security check.
1. For corporate users: Create a whitelist of allowed plugins and block known problematic plugins.
Conclusion: A Systemic Failure
The Urban VPN scandal reveals several important facts:
firstly,Browser extensions occupy a uniquely secure position. They run in the background, have extensive access to your browsing activity, and update automatically without prompting.
Latter,Marketplace regulations are inadequate. Plugins bearing "Featured" badges, affecting over 8 million users, remained active for months.
Thirdly,AI conversations have become a new data gold mine. People are telling AI assistants secrets they wouldn't tell search engines.
Fourth,The responsibility is being shared. Saying "you shouldn't have used a free VPN" is blaming the victim, but it's also unrealistic to overestimate the responsibility of AI companies.
Privacy should be an "infrastructure," not a "setting." But building that infrastructure requires all stakeholders—browser manufacturers, AI platforms, regulators, and users—to play their roles. This 2025 scandal shows that the entire digital security ecosystem is facing a test.
Source
1. KoiSecurity – “UrbanVPN AI Data Harvesting” (report, 2025).
2. Google Chrome Web Store – “Featured Extension Policy” (document, 2024).
3. BiScience – Privacy Policy https://urban‑vpn.com/privacy).
4. University of Wisconsin‑Madison – “ManifestV3 and Malicious Extensions” (2023).
5. SecureAnnex – “BiScience Data Brokerage” (2024).
6. ProtonBlog – “Lumo1.2 Release” (https://proton.me/blog/lumo-1-2).
7. https://www.csoonline.com/article/4106949/featured-urban-vpn-caught-stealing-private-ai-chats.html
First published: LinkedIn, 2025-12-29 08:23. Original article: https://www.linkedin.com/pulse/kurumsal-g%C3%BCvenlik-politikalar%C4%B1-%C3%A7er%C3%A7evesinde-urbanvpn-skandal%C4%B1-%C3%B6zhan-plsvf
Comments