Security brief
Malicious AI browser extensions copied legitimate tools to collect conversations
REVIEWOX Security’s reported campaign used lookalike extensions; model-provider names in the listings did not make those providers the attackers.
What happened
Dark Reading reported in January 2026 on OX Security’s investigation of two malicious Chrome extensions posing as AI sidebars. The extensions copied legitimate functionality while collecting conversation and browsing information for an external server.
The listings showed a combined audience exceeding 900,000 users, but install counts do not establish the exact number of people whose data was stolen. The report said both extensions had been removed.
Review installed extensions and their publishers, permissions and update history. If an affected extension was present, remove it and assess what conversations or account information it could access. A familiar AI brand in an extension title is not evidence of endorsement.
Next step
Review browser extensions and investigate exposure from any identified malicious extension.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
DAR