Hey there,

I'm breaking from my usual content because this can't wait.

If you use ChatGPT, Claude, or Gemini with Google Chrome, stop what you're doing and read this.

Yesterday, I came across a Forbes investigation by Zak Doffman that exposed something deeply disturbing: popular Chrome extensions have been secretly harvesting your AI conversations since July 2025 and selling that data to third parties.​

Medical questions. Financial information. Proprietary code. Personal problems.

Everything.​

6 million people had no idea it was happening.

Security researchers at Koi discovered that multiple Chrome extensions aren't just tracking your browsing. They're specifically targeting your AI conversations and monetizing them.

Here's the method:

When you visit ChatGPT, Claude, or Gemini, the extension injects custom tracking scripts directly into the page: chatgpt.js, claude.js, gemini.js.​

Then it captures:

The worst part? This is hardcoded. There's no opt-out setting. The only way to stop it is complete uninstallation.

The main culprit: Urban VPN Proxy with 6 million users.​

But Koi found the same code in seven other extensions from the same publisher, available on both Chrome and Edge.​

These extensions didn't launch with this feature. They added it through a silent update. Most users never noticed.

The irony? Urban VPN markets itself as protecting your privacy.

Let me be blunt about what "everything" means:​

All packaged and sold for "marketing analytics purposes".

This started in July 2025.​

That's five months of data collection from 6 million users.

Koi's warning: "Assume any AI conversations since July 2025 have been captured and shared with third parties".​

Think about everything you asked ChatGPT in five months.

Now assume someone else has all of it.

Review every extension. Ask:

If no to any question, delete it.

As Forbes cybersecurity expert Zak Doffman put it: "Your AI assistant is not your ally, financial consultant, doctor, or therapist. It's a computer operated by someone else".​

Stop treating AI like a confidant. Treat it like a public forum.

Urban VPN's privacy policy technically mentions this, but it's buried in legal text.​

The consent prompt mentions processing "ChatAI communication" but frames it as "protections," not data selling.​

The actual policy states: "We will collect prompts queried by End-Users" and "We disclose the prompts for analytics purposes".​

Translation: We're selling your conversations, but we wrote it so you'd miss it.

This isn't just one rogue extension.

We've been conditioned by decades of private messaging to think chat interfaces are confidential. They're not.​

ChatGPT's share feature has already led to private conversations being indexed by search engines. Names and emails became publicly searchable because users didn't understand how it worked.​

Then there's shadow AI: employees using AI outside company policies, uploading sensitive data without proper security.​

The issue isn't just malicious extensions. We're treating billion-dollar AI platforms like private therapists when they're data processing machines with complex monetization pressures.​

Forbes reached out for comments.​

OpenAI: No response
Google: No response
Urban Cyber Security: No response​

Silence.

Meanwhile, ChatGPT has 900 million weekly active users, but only 5% pay. That means 95% are "free users."​

And in tech, if you're not paying for the product, you might be the product.

After reading the Forbes investigation and doing my own research, here's what you need to know:

Rule 1: Never share what you wouldn't post publicly

Treat every AI conversation like it's going on Twitter. No names, addresses, financial details, health information.​

Rule 2: Use temporary chat features

ChatGPT has "temporary chat" that supposedly doesn't save conversations. Use it for sensitive topics.​

Rule 3: Audit extensions monthly

Set a calendar reminder. First of every month: review and delete unnecessary extensions.

Rule 4: Assume breach

Operate assuming whatever you share with AI could become public. If you're not comfortable with that, don't share it.

Rule 5: Rotate between providers

Don't put all sensitive conversations in one platform. Spread them across ChatGPT, Claude, and Gemini.​

This newsletter was inspired by and draws from:

Primary Source:
📰 How Your Private ChatGPT And Gemini Chats Are 'Sold For Profit' by Zak Doffman, Forbes (December 15, 2025)

Additional Research:

Full credit to Zak Doffman and Forbes for breaking this story.

If this helped you:

I read every response.

Stay safe.

P.S. I checked my own Chrome while writing this. Found two extensions I didn't remember installing. All deleted now.

See you next time,
Better Every Day