Urban VPN Extensions: AI Chat Collection Across 8M Installs

A dedicated script for every chatbot

Koi Security found that Urban VPN Proxy shipped a separate injected script for each AI site it targeted, chatgpt.js, claude.js, gemini.js and others named the same way, each one overriding the browser's own fetch and XMLHttpRequest functions on that page. That override let the extension read a user's prompt and the chatbot's response before either one ever reached the screen. [2][3]

The captured data, prompts, responses, timestamps and session or conversation identifiers, was packaged and sent to analytics.urban-vpn.com and stats.urban-vpn.com. The upload ran continuously and did not depend on the VPN itself being turned on, so a user who installed the extension purely for its stated VPN function was still monitored. [3][4]

One publisher, eight extensions, one data broker

Urban VPN Proxy, the extension Koi analyzed first, had about 6 million Chrome installs and 1.3 million on Microsoft Edge. Koi Security reported finding the same harvesting code in three more Urban Cyber Security extensions, 1ClickVPN Proxy, Urban Browser Guard and Urban Ad Blocker, putting the combined install base of the affected extensions at more than 8 million. [2]

All of the affected extensions are published by Urban Cyber Security Inc., which Koi ties to the data broker BiScience, B.I Science (2009) Ltd. BiScience sells clickstream and analytics products, including AdClarity, built from data collected through partner apps and browser extensions. [5][3]

The AI-conversation harvesting traces to a version 5.5.0 update pushed on July 9, 2025, roughly five months before Koi's report. Chatbots named as targets across the coverage include ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok and Meta AI. [4][2]

Marketed as protection, running regardless of consent

Urban VPN's own privacy materials describe some AI-related monitoring as serving user protection and analytics purposes, and Koi found no user-facing setting to turn the AI-site scripts off. Urban VPN Proxy also carried Google's "Featured" badge on the Chrome Web Store, a marker meant to signal that an extension follows platform best practices. [3][4]

Atlas interpretation: The gap here is between a stated purpose and an unremovable one. A VPN extension's job is to route traffic and, in Urban VPN's own framing, to protect users, not to read what they type into a chatbot on an unrelated site. Presenting the interception as a safety feature, with no toggle to decline it, describes something closer to a business model wearing a security label than a security feature with a side effect. [3]

Removed from the stores, not from the record

Coverage published in the days after the report described the four Chrome-listed extensions being pulled from the Chrome Web Store and, separately, from Microsoft Edge Add-ons within about a week of disclosure. Neither Urban Cyber Security nor Google issued a public response documented in that coverage. [2]

Atlas interpretation: A featured badge and a functioning VPN are evidence that an extension does what it claims to do, not evidence of what else it does. The removal came from outside researchers reverse-engineering the code, after roughly five months and eight million installs, rather than from the review process that had already approved and featured the extension. [3][2]