Besides ChatGPT, Claude and Gemini, the extensions collect all conversations from Copilot, Perplexity, DeepSeek, Grok and Meta AI. Coie said a full description of the data collected includes:
- Every invitation a user sends to AI
- Every response received
- Conversation IDs and timestamps
- Session metadata
- The specific AI platform and model used
The executor script runs independently of VPN, ad blocking, or other core functionality. This means that even when a user turns off VPN, AI protection, ad blocking or other features, conversation collection continues. The only way to stop collection is to disable the extension in your browser settings or remove it.
Koi reported that it first discovered the collection of conversations in City VPN proxyan extension of VPN routing, one of the benefits of which is “artificial intelligence protection.” Data collection began in early July with the release of version 5.5.0.
“Anyone who used ChatGPT, Claude, Gemini or other targeted platforms when Urban VPN was installed after July 9, 2025 should assume that those conversations are now residing on Urban VPN servers and have been transferred to third parties,” the company said. “Medical matters, financial details, proprietary code, personal dilemmas are all sold for “marketing analytics purposes.”
Following this discovery, the security firm discovered seven additional extensions with identical AI data collection capabilities. Four extensions are available in the Chrome Web Store. The other four are on the Edge add-ons page. Collectively, they have been installed more than 8 million times.
They are:
Chrome Store
- City VPN Proxy: 6 million users
- Proxy 1ClickVPN: 600,000 users
- Urban Browser Guard: 40,000 users.
- City ad blocker: 10,000 users
Edge additions:
- City VPN Proxy: 1.32 million users
- Proxy server 1ClickVPN: 36,459 users.
- Urban Browser Guard – 12,624 users
- Urban Ad Blocker – 6,476 users
Read the fine print
The extensions contain conflicting messages about how they handle conversations with bots, which often contain deeply personal information about users' physical and mental health, finances, personal relationships and other sensitive information that can be a goldmine for marketers and data brokers. City VPN proxy the Chrome Web Store, for example, lists “AI protection” as a benefit. It goes on to say:
