Malicious Ad-blocker Extensions Exfiltrate AI Chat Data
Security researchers at MalExt Sentry disclosed a campaign called "PromptSnatcher" on June 13, 2026, in which two Chrome extensions posing as ad blockers, "Smart Adblocker" (about 80,000 users) and "Adblock for Browser" (about 10,000 users), secretly recorded AI chat conversations from roughly 90,000 users combined, according to Notebookcheck's report on the disclosure. The extensions captured chats from eight AI platforms including ChatGPT, Gemini, and Claude, storing up to 10,000 characters of prompts and 30,000 characters of responses plus metadata like model choice and subscription status, then transmitting the data via an internal system the researchers call Panel 231. The collection was concealed behind a consent toggle labeled "Enhanced Protection" that did not disclose AI-chat recording. For practitioners, the campaign is a concrete reminder that browser extensions with page-level access are a direct exfiltration vector for both prompts and model outputs.
Browser extensions that render page content or intercept site traffic are a persistent, underappreciated source of data-exfiltration risk for AI workflows. Prompts and completions often contain sensitive personal and corporate data, so extensions with page-level access can effectively bypass the application-layer privacy expectations teams rely on for model selection, auditing, and compliance.
What happened
Notebookcheck reports that security researchers at MalExt Sentry disclosed a campaign they named PromptSnatcher on June 13, 2026. The researchers attribute the activity to two browser extensions, Smart Adblocker (extension ID iojpcjjdfhlcbgjnpngcmaojmlokmeii, approximately 80,000 users) and Adblock for Browser (extension ID jcbjcocinigpbgfpnhlpagidbmlngnnn, approximately 10,000 users). The extensions did block ads using public filter lists while also covertly recording conversations on eight AI platforms, including ChatGPT, Gemini, Claude, Copilot, Perplexity, DeepSeek, Grok, and Meta AI. The captured payload could include up to 10,000 characters of prompts and up to 30,000 characters of responses, plus metadata such as model choice and subscription status, transmitted to developer servers using an internal system researchers call Panel 231 (MalExt Sentry; Notebookcheck; CybersecurityNews).
Technical context
CybersecurityNews' independent coverage of the disclosure describes a shared-page-capture.js script and an "LDP_MESSAGE" protocol used to relay captured conversation data to the Panel 231 backend, and notes that the extensions' Firefox manifest declared "data_collection_permissions: none" despite the active capture behavior. According to Notebookcheck, the extensions concealed data collection behind a consent option labeled "Enhanced Protection" without disclosing that AI chats were being recorded, and while Meta AI was not originally enumerated in the code, remote configuration could enable additional targeting later.
For practitioners
Treat browser extensions with page access as possible exfiltration endpoints when evaluating threat models for prompt engineering, data classification, and live demos. Review extension permissions, isolate sensitive work to controlled browser profiles or environments, and prefer platform-level privacy controls where available. These are general risk-management steps, not claims about any AI platform's internal controls.
What to watch
Whether browser extension stores remove the identified extensions, whether affected developers publish disclosure statements, and whether further instances of the Panel 231 infrastructure appear in other extensions. Notebookcheck, MalExt Sentry, and CybersecurityNews are the reporting sources for the details above.
Key Points
- 1Two malicious ad-blocker extensions harvested AI chat data from roughly 90,000 users across eight platforms including ChatGPT, Claude, and Gemini.
- 2Malicious extensions often keep their advertised functionality working while covertly harvesting sensitive data behind a mislabeled consent toggle.
- 3Practitioners using web-based LLMs should treat prompt and response content as potentially observable by third-party client-side browser code.
Scoring Rationale
A confirmed, technically detailed threat (primary MalExt Sentry report plus independent corroboration) affecting roughly 90,000 users across eight major AI platforms including Claude, ChatGPT, and Gemini, with a clear and actionable practitioner threat model, justifying the notable-to-major tier.
Sources
Primary source and supporting public references used for this report.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Ad Tech problems
