AI Governance Institute
← News
Research2026-08-11

Banned AI Chat-Scraping Extension Returns via Chrome's Own CDN

What happened

Netskope Threat Labs published research on August 11, 2026, documenting that a Chrome extension banned for stealing AI chats has returned to the Chrome Web Store after its initial removal in January 2026. The extension, now at version 1.7.3.0, carries code classified as Trojan.GenericFCA.Script.37952 that exploits browser update and uninstall events to generate affiliate commissions while maintaining access to user sessions. More critically, the extension retains the same functionality that earned its original ban: the ability to scrape conversations from AI assistants including ChatGPT and DeepSeek as users interact with them. Because the extension is distributed through Google's own CDN infrastructure, it bypasses many perimeter controls that rely on blocking unknown or untrusted domains. The incident is a direct continuation of an AI data exfiltration vector that enterprise security teams may have considered resolved after the January ban, and it demonstrates that platform-level removal is not a durable control against persistent threat actors who can simply resubmit.

Why it matters

  • ·AI conversation data flowing through browser extensions sits outside most enterprise DLP and CASB tooling, a gap documented earlier this year in CASB and DLP Cannot See Inside AI Prompts. This incident confirms that even after a malicious extension is removed from a platform store, the exfiltration risk resurfaces unless organizations maintain their own positive-allowlist controls over installed extensions.
  • ·The use of Google's CDN as the delivery channel directly undermines domain-blocklist approaches, meaning organizations that rely on network-layer filtering as their primary browser extension control now have a demonstrable gap in their third-party software intake process. Controls governing shadow AI and third-party widget inventory need to cover installed browser extensions that interact with sanctioned AI tools, not just standalone AI applications.
  • ·Enterprises in regulated industries where AI conversation content may contain personal data, privileged communications, or material non-public information face direct regulatory exposure if this extension reaches employee endpoints. Data exfiltration through a sanctioned distribution channel may constitute a notifiable breach under applicable data protection regimes, triggering incident disclosure obligations.

Governance controls affected

PRC-014Shadow AI and Third-Party Widget Inventory and ClassificationDGC-002PII Handling in AI SystemsSEC-003Sensitive Data Handling in AI PipelinesIRC-001AI Incident ClassificationAGT-019AI Tool and Plugin Supply Chain Risk Assessment

What to do now

  • ☐Audit all browser extensions currently installed on enterprise endpoints that have permissions to read or modify content on AI assistant domains including chat.openai.com and chat.deepseek.com.
  • ☐Implement a positive allowlist for browser extensions on managed devices so that only explicitly approved extensions can run, rather than relying on Chrome Web Store removal actions as a control.
  • ☐Search endpoint management logs for installations of any extension previously flagged in January 2026 as scraping AI conversation data, including under new names or version numbers.
  • ☐Update your AI acceptable-use policy to explicitly require employees to report unsanctioned browser extensions that interact with AI tools, and communicate this requirement in the next training cycle.
  • ☐Assess whether any AI conversation content exfiltrated through this channel constitutes a reportable data incident under applicable data protection requirements, and initiate an incident classification review accordingly.

What to watch next

Compliance teams should monitor whether Google strengthens its Chrome Web Store review processes following this resubmission, since platform-level controls have now demonstrably failed twice on the same extension. The broader pattern of trojanized AI tooling reaching enterprise endpoints through trusted channels, including the earlier 1.7M trojanized AI skill installs incident, suggests that browser and marketplace supply chain security will face increasing regulatory scrutiny. Teams operating under the OWASP Top 10 for Large Language Model Applications framework should revisit their supply chain risk entries in light of this confirmed reinfection vector.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-08-26

Exploited MLflow SSRF and AI-Generated PLC Attacks Converge on AI Infrastructure

The Cloud Security Alliance's August 23 CISO Daily Briefing flags two AI-infrastructure security findings with direct compliance implications. An actively exploited server-side request forgery flaw in MLflow is being used to steal cloud credentials from model-serving environments. A separate joint government advisory warns that AI-generated Python scripts are enabling attacks on Siemens S7 programmable logic controllers used in industrial settings.

Research2026-09-05

Microsoft: Agentic Security Requires Tool-Layer Controls, Not Just Model Guardrails

Microsoft's Security Blog published guidance on June 30, 2026, arguing that security controls for AI agents must be applied at the tool layer rather than relying solely on model-level guardrails. The guidance covers allowlisting MCP publishers, inspecting tool metadata, applying data loss prevention at the tool call parameter level, and correlating telemetry across agent actions. It directly implicates third-party risk programs, DLP frameworks, and agent audit trail requirements.

Corporate Policy2026-09-03

Simultaneous ChatGPT, Grok, and Claude Outage Exposes AI Concentration Risk

On September 3, 2026, OpenAI's ChatGPT, xAI's Grok, and Anthropic's Claude experienced simultaneous outages affecting millions of users globally. ChatGPT reported elevated errors across logins, file uploads, voice mode, and image generation, while Anthropic attributed its disruption to an infrastructure issue resolved by 12:15 PM ET. The concurrent nature of the failures raises unresolved questions about shared upstream dependencies and leaves enterprise business continuity programs exposed.