Banned AI Chat-Scraping Extension Returns via Chrome's Own CDN
Source
Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious ActivitiesNetskope Threat Labs
What happened
Netskope Threat Labs published research on August 11, 2026, documenting that a Chrome extension banned for stealing AI chats has returned to the Chrome Web Store after its initial removal in January 2026. The extension, now at version 1.7.3.0, carries code classified as Trojan.GenericFCA.Script.37952 that exploits browser update and uninstall events to generate affiliate commissions while maintaining access to user sessions. More critically, the extension retains the same functionality that earned its original ban: the ability to scrape conversations from AI assistants including ChatGPT and DeepSeek as users interact with them. Because the extension is distributed through Google's own CDN infrastructure, it bypasses many perimeter controls that rely on blocking unknown or untrusted domains. The incident is a direct continuation of an AI data exfiltration vector that enterprise security teams may have considered resolved after the January ban, and it demonstrates that platform-level removal is not a durable control against persistent threat actors who can simply resubmit.
Why it matters
- ·AI conversation data flowing through browser extensions sits outside most enterprise DLP and CASB tooling, a gap documented earlier this year in CASB and DLP Cannot See Inside AI Prompts. This incident confirms that even after a malicious extension is removed from a platform store, the exfiltration risk resurfaces unless organizations maintain their own positive-allowlist controls over installed extensions.
- ·The use of Google's CDN as the delivery channel directly undermines domain-blocklist approaches, meaning organizations that rely on network-layer filtering as their primary browser extension control now have a demonstrable gap in their third-party software intake process. Controls governing shadow AI and third-party widget inventory need to cover installed browser extensions that interact with sanctioned AI tools, not just standalone AI applications.
- ·Enterprises in regulated industries where AI conversation content may contain personal data, privileged communications, or material non-public information face direct regulatory exposure if this extension reaches employee endpoints. Data exfiltration through a sanctioned distribution channel may constitute a notifiable breach under applicable data protection regimes, triggering incident disclosure obligations.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Audit all browser extensions currently installed on enterprise endpoints that have permissions to read or modify content on AI assistant domains including chat.openai.com and chat.deepseek.com.
- ☐Implement a positive allowlist for browser extensions on managed devices so that only explicitly approved extensions can run, rather than relying on Chrome Web Store removal actions as a control.
- ☐Search endpoint management logs for installations of any extension previously flagged in January 2026 as scraping AI conversation data, including under new names or version numbers.
- ☐Update your AI acceptable-use policy to explicitly require employees to report unsanctioned browser extensions that interact with AI tools, and communicate this requirement in the next training cycle.
- ☐Assess whether any AI conversation content exfiltrated through this channel constitutes a reportable data incident under applicable data protection requirements, and initiate an incident classification review accordingly.
What to watch next
Compliance teams should monitor whether Google strengthens its Chrome Web Store review processes following this resubmission, since platform-level controls have now demonstrably failed twice on the same extension. The broader pattern of trojanized AI tooling reaching enterprise endpoints through trusted channels, including the earlier 1.7M trojanized AI skill installs incident, suggests that browser and marketplace supply chain security will face increasing regulatory scrutiny. Teams operating under the OWASP Top 10 for Large Language Model Applications framework should revisit their supply chain risk entries in light of this confirmed reinfection vector.