Illustration by Tag Hartman-Simkins/Futurism. Source: Getty Images
You know those memes How come there is no such thing as a free VPN? Here’s the ultimate cautionary tale.
A recent investigation A massive data harvesting operation involving a voluntary extension on Google’s Chrome browser was disclosed by Tel Aviv-based security firm Koei. This free extension, called Urban VPN Proxy, has nearly six million users at the time of writing, and even has a “Featured” badge on the Chrome Web Store – in other words, an endorsement from Google itself.
As researcher Idan Dardikman writes, the expansion goes beyond the functions of a typical VPN. “Executor” scripts packaged under the hood are designed to intercept and capture conversations from major AI platforms, including OpenAI’s ChatGPT, Anthropic’s Cloud, Google’s Gemini, DeepSeek, and XAI. Grok.
The data collected includes everything a user might ask their chosen AI chatbot, according to Dardikman, including “medical questions, financial details, proprietary codes, personal dilemmas, all of which is sold for ‘marketing analytics purposes’.”
Whether the VPN is on or off, Urban VPN Proxy is constantly scraping conversation data. The script is enabled by default, meaning that from the moment someone downloads the extension, chatbot gabbing is fair game.
worse yet, forbes notes“There is no user-facing toggle to disable it. The only way to stop data collection is to uninstall the extension completely.”
The company behind Urban VPN Proxy, Urban Cyber ​​Security Inc., is by no means shy about this. As Dardikman observes, the company’s privacy policy clearly states that “we share web browsing data with our affiliated company,” a data broker called ByScience, “which uses this raw data and creates insights that are used commercially and shared with business partners.”
Despite this, Urban VPN Proxy Pages on Chrome Web Store Declares that “your data is not being sold to third parties, outside of approved use cases,” and “is not being used or transferred for purposes that are unrelated to the core functionality of the item.”
Although this revelation may be shocking to Urban VPN Proxy’s six million users, it certainly isn’t the only app running this scheme. In fact, forbes Note that seven additional apps from the same publisher have over two million subscribers, each with “similar AI harvesting functionality.” All but one of them carry a “Featured” badge, courtesy of Google’s Chrome Web Store.
As Koi’s Dardikman writes, “If you have any of these extensions installed, uninstall them now. Assume that any AI conversation you have since July 2025 has been captured and shared with third parties.”
Even if your apps weren’t developed by this company, it might be a good time to start scouring their own privacy policies for similar scraping permissions. As Dardikman shows, when it comes to data harvesting, all bets are off.
More information on data privacy: Regular people are rising up against AI surveillance cameras
