AI Governance Institute
← News
Research2026-08-11

Banned AI Chat-Scraping Extension Returns via Chrome's Own CDN

What happened

Netskope Threat Labs published research on August 11, 2026, documenting that a Chrome extension banned for stealing AI chats has returned to the Chrome Web Store after its initial removal in January 2026. The extension, now at version 1.7.3.0, carries code classified as Trojan.GenericFCA.Script.37952 that exploits browser update and uninstall events to generate affiliate commissions while maintaining access to user sessions. More critically, the extension retains the same functionality that earned its original ban: the ability to scrape conversations from AI assistants including ChatGPT and DeepSeek as users interact with them. Because the extension is distributed through Google's own CDN infrastructure, it bypasses many perimeter controls that rely on blocking unknown or untrusted domains. The incident is a direct continuation of an AI data exfiltration vector that enterprise security teams may have considered resolved after the January ban, and it demonstrates that platform-level removal is not a durable control against persistent threat actors who can simply resubmit.

Why it matters

  • ·AI conversation data flowing through browser extensions sits outside most enterprise DLP and CASB tooling, a gap documented earlier this year in CASB and DLP Cannot See Inside AI Prompts. This incident confirms that even after a malicious extension is removed from a platform store, the exfiltration risk resurfaces unless organizations maintain their own positive-allowlist controls over installed extensions.
  • ·The use of Google's CDN as the delivery channel directly undermines domain-blocklist approaches, meaning organizations that rely on network-layer filtering as their primary browser extension control now have a demonstrable gap in their third-party software intake process. Controls governing shadow AI and third-party widget inventory need to cover installed browser extensions that interact with sanctioned AI tools, not just standalone AI applications.
  • ·Enterprises in regulated industries where AI conversation content may contain personal data, privileged communications, or material non-public information face direct regulatory exposure if this extension reaches employee endpoints. Data exfiltration through a sanctioned distribution channel may constitute a notifiable breach under applicable data protection regimes, triggering incident disclosure obligations.

Governance controls affected

PRC-014Shadow AI and Third-Party Widget Inventory and ClassificationDGC-002PII Handling in AI SystemsSEC-003Sensitive Data Handling in AI PipelinesIRC-001AI Incident ClassificationAGT-019AI Tool and Plugin Supply Chain Risk Assessment

What to do now

  • ☐Audit all browser extensions currently installed on enterprise endpoints that have permissions to read or modify content on AI assistant domains including chat.openai.com and chat.deepseek.com.
  • ☐Implement a positive allowlist for browser extensions on managed devices so that only explicitly approved extensions can run, rather than relying on Chrome Web Store removal actions as a control.
  • ☐Search endpoint management logs for installations of any extension previously flagged in January 2026 as scraping AI conversation data, including under new names or version numbers.
  • ☐Update your AI acceptable-use policy to explicitly require employees to report unsanctioned browser extensions that interact with AI tools, and communicate this requirement in the next training cycle.
  • ☐Assess whether any AI conversation content exfiltrated through this channel constitutes a reportable data incident under applicable data protection requirements, and initiate an incident classification review accordingly.

What to watch next

Compliance teams should monitor whether Google strengthens its Chrome Web Store review processes following this resubmission, since platform-level controls have now demonstrably failed twice on the same extension. The broader pattern of trojanized AI tooling reaching enterprise endpoints through trusted channels, including the earlier 1.7M trojanized AI skill installs incident, suggests that browser and marketplace supply chain security will face increasing regulatory scrutiny. Teams operating under the OWASP Top 10 for Large Language Model Applications framework should revisit their supply chain risk entries in light of this confirmed reinfection vector.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Insight2026-10-04

Good Architecture Did Not Save Muse. Employees Already Run Both Kinds of Agent.

Six weeks of consumer AI agent deployments exposed two incompatible facts for enterprise compliance teams. Instinct shipped with no documented agentic governance architecture and raised $1 billion at a $10 billion valuation. Muse shipped with the most detailed consumer governance architecture on the market and still failed on three separate surfaces within six weeks.

Corporate Policy2026-10-10

White House AI Incident Mandate Lacks Enforcement Teeth, Exposing Internal Program Gaps

The White House has directed AI companies to disclose and remediate security incidents involving their models, reportedly triggered by Anthropic reporting unauthorized use of government systems. The directive carries no specified thresholds, deadlines, or penalties, leaving its enforceability uncertain. Compliance teams should treat the gap as a prompt to audit their own incident reporting programs, not wait for federal rules to fill it.

Enforcement2026-10-10

ICO Opens Formal Grok Investigation Into Data Processing and Harmful Synthetic Images

The UK Information Commissioner's Office has opened formal investigations into X Internet Unlimited Company and X.AI LLC. The probe covers how Grok processes personal data and its capacity to generate harmful sexualized synthetic images and videos. Enterprise teams should treat the case as an enforcement signal for any AI system capable of generating synthetic media involving real people.