AI Governance Institute
← News
Research2026-08-11

Banned AI Chat-Scraping Extension Returns via Chrome's Own CDN

What happened

Netskope Threat Labs published research on August 11, 2026, documenting that a Chrome extension banned for stealing AI chats has returned to the Chrome Web Store after its initial removal in January 2026. The extension, now at version 1.7.3.0, carries code classified as Trojan.GenericFCA.Script.37952 that exploits browser update and uninstall events to generate affiliate commissions while maintaining access to user sessions. More critically, the extension retains the same functionality that earned its original ban: the ability to scrape conversations from AI assistants including ChatGPT and DeepSeek as users interact with them. Because the extension is distributed through Google's own CDN infrastructure, it bypasses many perimeter controls that rely on blocking unknown or untrusted domains. The incident is a direct continuation of an AI data exfiltration vector that enterprise security teams may have considered resolved after the January ban, and it demonstrates that platform-level removal is not a durable control against persistent threat actors who can simply resubmit.

Why it matters

  • ·AI conversation data flowing through browser extensions sits outside most enterprise DLP and CASB tooling, a gap documented earlier this year in CASB and DLP Cannot See Inside AI Prompts. This incident confirms that even after a malicious extension is removed from a platform store, the exfiltration risk resurfaces unless organizations maintain their own positive-allowlist controls over installed extensions.
  • ·The use of Google's CDN as the delivery channel directly undermines domain-blocklist approaches, meaning organizations that rely on network-layer filtering as their primary browser extension control now have a demonstrable gap in their third-party software intake process. Controls governing shadow AI and third-party widget inventory need to cover installed browser extensions that interact with sanctioned AI tools, not just standalone AI applications.
  • ·Enterprises in regulated industries where AI conversation content may contain personal data, privileged communications, or material non-public information face direct regulatory exposure if this extension reaches employee endpoints. Data exfiltration through a sanctioned distribution channel may constitute a notifiable breach under applicable data protection regimes, triggering incident disclosure obligations.

Governance controls affected

PRC-014Shadow AI and Third-Party Widget Inventory and ClassificationDGC-002PII Handling in AI SystemsSEC-003Sensitive Data Handling in AI PipelinesIRC-001AI Incident ClassificationAGT-019AI Tool and Plugin Supply Chain Risk Assessment

What to do now

  • ☐Audit all browser extensions currently installed on enterprise endpoints that have permissions to read or modify content on AI assistant domains including chat.openai.com and chat.deepseek.com.
  • ☐Implement a positive allowlist for browser extensions on managed devices so that only explicitly approved extensions can run, rather than relying on Chrome Web Store removal actions as a control.
  • ☐Search endpoint management logs for installations of any extension previously flagged in January 2026 as scraping AI conversation data, including under new names or version numbers.
  • ☐Update your AI acceptable-use policy to explicitly require employees to report unsanctioned browser extensions that interact with AI tools, and communicate this requirement in the next training cycle.
  • ☐Assess whether any AI conversation content exfiltrated through this channel constitutes a reportable data incident under applicable data protection requirements, and initiate an incident classification review accordingly.

What to watch next

Compliance teams should monitor whether Google strengthens its Chrome Web Store review processes following this resubmission, since platform-level controls have now demonstrably failed twice on the same extension. The broader pattern of trojanized AI tooling reaching enterprise endpoints through trusted channels, including the earlier 1.7M trojanized AI skill installs incident, suggests that browser and marketplace supply chain security will face increasing regulatory scrutiny. Teams operating under the OWASP Top 10 for Large Language Model Applications framework should revisit their supply chain risk entries in light of this confirmed reinfection vector.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Corporate Policy2026-09-09

Meta Muse Puts Personal AI Agent Governance on the Enterprise Radar

Meta has introduced Muse, a personal AI agent designed to assist users with tasks, planning, and decision-making across Meta's platforms. Muse is positioned as an ambient, proactive assistant capable of taking actions on behalf of users. Enterprise compliance teams must now assess how employee use of Muse intersects with data privacy obligations, agentic control frameworks. Third-party AI risk programs.

Research2026-09-18

Plugin4Shell Flaw Breaks Approved-Plugin Controls Across Four Major AI Coding Agents

Researchers at cybersecurity startup AIR disclosed a zero-click remote code execution vulnerability, dubbed Plugin4Shell, affecting OpenAI Codex, Anthropic Claude Code, Google Gemini CLI, and GitHub Copilot. The flaw exploits a weakness in how these agents verify plugin integrity using Git SHA hashes, allowing an attacker who controls a plugin repository to substitute malicious code that runs even when the agent is instructed to execute a reviewed, approved version. Because affected agents typically run with full developer credentials, successful exploitation can expose source code, API keys, cloud credentials, and CI/CD pipelines.

Research2026-09-14

Congressional Probes of DoorDash, Apple, and Cursor Put Chinese Open-Model Adoption on Notice

A practitioner reading list compiled by researcher Nathan Lambert maps the compliance exposure enterprises face when adopting open-weight AI models, particularly those of Chinese origin. Congressional probes into DoorDash, Airbnb, Cursor, and Apple for using Chinese open models have moved this from a technical question to an active regulatory risk. Enterprise governance teams now face pressure to formalize intake, origin assessment, and distillation disclosure practices for open-weight models.