A Google Chrome extension called Urban VPN Proxy, boasting six million users and a "Featured" badge, has been found to secretly collect user prompts and responses from various AI chatbots, including OpenAI's ChatGPT and Microsoft's Copilot. Despite its claims of protecting user privacy as a VPN, the extension was updated on July 9, 2025, to enable AI data harvesting by default. It uses JavaScript to intercept conversations, capturing prompts, chatbot responses, and metadata, which it sends to remote servers. The company behind Urban VPN, Urban Cyber Security Inc., has stated that it collects this data to enhance Safe Browsing and for marketing analytics. However, their privacy policy raises concerns, as it admits that sensitive personal information could be processed, and they cannot guarantee complete anonymity. The data is shared with BIScience, a firm that creates commercial insights from users' raw data. This same company has previously been criticized for misleading privacy practices. Koi Security's findings indicate that three other extensions from the same publisher also harvest AI conversation data, bringing their total user base to over eight million. Despite the "Featured" badge suggesting a level of trust and quality, this situation highlights the risks of relying on extension marketplaces where user data can be exploited. Following the report, all four extensions were removed from the Chrome Web Store by December 18, 2025, while the Edge versions remained available but lost their "Featured" status.