Browser extensions harvested private AI chats into a commercial database
A researcher found private chatbot conversations captured by browser extensions, stored in a vector database and sold through an API. The data included healthcare workers pasting patient details and people asking about their immigration status.
- Disclosed
- 3 Mar 2026
- Organization
- AI chatbot users
- Vendor
- Multiple models
- Product
- Browser extensions
- Kind of AI
- Chatbot
- AI's role
- AI was the target
- How it happened
- Supply chain and access: Third-party leak
- Harm
- Data exposed
- Data involved
- Chat logs, Personal data, Health
- Reach
- Many organizations
- Severity
- High
- Model at fault
- No
- Status
- Reported